DEREF_OF_NULL.EX.COND

[kuznetsovvvv]

PolarDB-for-PostgreSQL/src/interfaces/ecpg/preproc/descriptor.c

Lines 180 to 206 in accf02e

	void
	output_get_descr(char *desc_name, char *index)
	{
	struct assignment *results;
	fprintf(base_yyout, "{ ECPGget_desc(__LINE__, %s, %s,", desc_name, index);
	for (results = assignments; results != NULL; results = results->next)
	{
	const struct variable *v = find_variable(results->variable);
	char *str_zero = mm_strdup("0");
	switch (results->value)
	{
	case ECPGd_nullable:
	mmerror(PARSE_ERROR, ET_WARNING, "nullable is always 1");
	break;
	case ECPGd_key_member:
	mmerror(PARSE_ERROR, ET_WARNING, "key_member is always 0");
	break;
	default:
	break;
	}
	fprintf(base_yyout, "%s,", get_dtype(results->value));
	ECPGdump_a_type(base_yyout, v->name, v->type, v->brace_level,
	NULL, NULL, -1, NULL, NULL, str_zero, NULL, NULL);
	free(str_zero);
	}

I have found two potential vulnerabilities in lines 203 and 313.

The function does not check that ind_name can be NULL. NULL can be dereferenced, which can cause undefined behavior in the program. The ECPGdump_a_type function, which calls the ECPGdump_a_struct function, does not check that ind_name == NULL, so the parameter is not checked.
The situation is the same in line 313