-
Notifications
You must be signed in to change notification settings - Fork 45
Open
Description
Hello,
Our team has recently been conducting research on a null-pointer-dereference (NPD) vulnerability detection tool and used it to scan qengine(the version on the master branch). After a manual review, we have identified some potentially vulnerable code snippets that may lead to null-pointer-dereference bugs.
The NULL Dereference vulnerability happens in void R_StepActiveU(), src/client/renderer/sw_edge.c
How the NULL Pointer Dereference happens:
- When
pwedge == NULL - NULL dereference of variable
pwedgehappens atpedge->next = pwedge->next;
void R_StepActiveU(edge_t *pedge)
{
edge_t *pnext_edge, *pwedge;
while (1) {
pedge->u += pedge->u_step;
......
pwedge = pedge->prev->prev;
=> while (pwedge && (pwedge->u > pedge->u)) {
pwedge = pwedge->prev;
//when pwedge == NULL -> break
}
=> pedge->next = pwedge->next;
......
}
}
Metadata
Metadata
Assignees
Labels
No labels