diff options
author | Markus Armbruster <armbru@redhat.com> | 2015-01-27 17:13:52 +0100 |
---|---|---|
committer | Michael Tokarev <mjt@tls.msk.ru> | 2015-02-10 09:27:20 +0300 |
commit | afb30dde3ad71349fc65726946d58e5d3c61f8af (patch) | |
tree | 4467ee905e89ff5fe7db42d9a230f9233e73191d /util/uri.c | |
parent | afd5ea3671f936f511015a71af9cd0ed23788515 (diff) | |
download | qemu-afb30dde3ad71349fc65726946d58e5d3c61f8af.zip qemu-afb30dde3ad71349fc65726946d58e5d3c61f8af.tar.gz qemu-afb30dde3ad71349fc65726946d58e5d3c61f8af.tar.bz2 |
util/uri: URI member path can be null, compare more carfully
uri_resolve_relative() calls strcmp(bas->path, ref->path). However,
either argument could be null! Evidence: the code checks for null
after the comparison. Spotted by Coverity.
I suspect this was screwed up when we stole the code from libxml2.
There the conditional reads
xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)
with
int
xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
if (str1 == str2) return(1);
if (str1 == NULL) return(0);
if (str2 == NULL) return(0);
do {
if (*str1++ != *str2) return(0);
} while (*str2++);
return(1);
}
Fix by replicating libxml2's logic faithfully.
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'util/uri.c')
-rw-r--r-- | util/uri.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -1935,7 +1935,8 @@ uri_resolve_relative (const char *uri, const char * base) val = g_strdup (uri); goto done; } - if (!strcmp(bas->path, ref->path)) { + if (bas->path == ref->path || + (bas->path && ref->path && !strcmp(bas->path, ref->path))) { val = g_strdup(""); goto done; } |