A couple of places were missing NULL return value checks for
mdb_read_table()'s return value. Add these.
This fixes a NULL pointer deref while running ./test_script.sh
on the test mdb file from oss-fuzz/35972 .
Note this does NOT fix the original problem reported in oss-fuzz/35972
which reports a "Dynamic-stack-buffer-overflow WRITE 16" issue,
which I've been unable to reproduce.
The oss-fuzz/36187 attached
clusterfuzz-testcase-minimized-fuzz_mdb-4756071066501120
has a table with a map_sz of 0 and the g_memdup2 call returns NULL for
this, while mdb_map_find_next unconditionally derefs table->usage_map
to read the first byte which contains the map-type.
This leads to a NULL-ptr deref (at least with -fsanitize=address builds),
fix this by rejecting tables with a map_sz of 0.
Note this does NOT fix the original problem reported in oss-fuzz/36187
which reports a "Dynamic-stack-buffer-overflow WRITE 16" issue, which
I've been unable to reproduce.
Use a local variable instead of casting the address of a SQLSMALLINT
to a (size_t *). sizeof(SQLSMALLINT) < sizeof(size_t) so gcc is
rightfully giving the following errors when building on Fedora 34:
/usr/include/sqlucode.h: In function 'SQLErrorW':
odbc.c:130:20: error: array subscript 'size_t[0]' is partly outside array bounds of 'SQLSMALLINT[1]' [-Werror=array-bounds]
130 | size_t lin=*_lin, lout=*_lout;
| ^~~~~
odbc.c:974:21: note: while referencing 'pcbErrorMsg8'
974 | SQLSMALLINT pcbErrorMsg8;
| ^~~~~~~~~~~~
odbc.c:133:15: error: array subscript 'size_t[0]' is partly outside array bounds of 'SQLSMALLINT[1]' [-Werror=array-bounds]
133 | *_lin -= lin;
| ^~
odbc.c:974:21: note: while referencing 'pcbErrorMsg8'
974 | SQLSMALLINT pcbErrorMsg8;
| ^~~~~~~~~~~~
odbc.c:133:15: error: array subscript 'size_t[0]' is partly outside array bounds of 'SQLSMALLINT[1]' [-Werror=array-bounds]
133 | *_lin -= lin;
| ~~~~~~^~~~~~
odbc.c:974:21: note: while referencing 'pcbErrorMsg8'
974 | SQLSMALLINT pcbErrorMsg8;
| ^~~~~~~~~~~~
cc1: all warnings being treated as errors
Hans de Goede