Skip to content

Fix the null reference vulnerability. #13

@QiuYitai

Description

@QiuYitai

Hello,
Our team has recently been conducting research on a null-pointer-dereference (NPD) vulnerability detection tool and used it to scan qengine(the version on the master branch). After a manual review, we have identified some potentially vulnerable code snippets that may lead to null-pointer-dereference bugs.
The NULL Dereference vulnerability happens in void R_StepActiveU(), src/client/renderer/sw_edge.c
How the NULL Pointer Dereference happens:

  1. When pwedge == NULL
  2. NULL dereference of variable pwedge happens at pedge->next = pwedge->next;
void R_StepActiveU(edge_t *pedge)
{
    edge_t *pnext_edge, *pwedge;
    while (1) {
        pedge->u += pedge->u_step;
        ......
        pwedge = pedge->prev->prev;
=>      while (pwedge && (pwedge->u > pedge->u)) {
            pwedge = pwedge->prev;
        //when pwedge == NULL -> break
        }
=>      pedge->next = pwedge->next;
        ......
    }        
 }

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions