对yajl进行故障注入，hand出现内存分配失败没有判空，导致coredump

【标题描述】对yajl进行故障注入，hand出现内存分配失败没有判空，导致coredump
【环境信息】
硬件信息：
与硬件无关
软件信息：
5.10
【问题复现步骤】
1.使用isula调用yajl
2.过程中使用fustiontes的自动故障注入afi，对afi模块的所有内存分配点进行上下文敏感的内存故障注入
说明：本bug故障注入点：
hand = (yajl_handle) YA_MALLOC(afs, sizeof(struct yajl_handle_t))(故障注入内存分配失败)
注入上下文
```
Core was generated by `/usr/bin/isulad'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/src/debug/yajl-2.1.0-15.h2.eulerosv2r11.x86_64/src/yajl.c:69
69          hand->callbacks = callbacks;
Missing separate debuginfos, use: dnf debuginfo-install abseil-cpp-20210324.2-1.h1.eulerosv2r11.x86_64 attr-2.5.1-2.h2.eulerosv2r11.x86_64 brotli-1.0.9-2.eulerosv2r11.x86_64 bzip2-1.0.8-4.h6.eulerosv2r11.x86_64 c-ares-1.18.1-1.h1.eulerosv2r11.x86_64 clibcni-2.0.7-1.h6.eulerosv2r11.x86_64 cyrus-sasl-lib-2.1.27-13.h7.eulerosv2r11.x86_64 device-mapper-1.02.181-4.h7.eulerosv2r11.x86_64 e2fsprogs-1.46.4-7.h7.eulerosv2r11.x86_64 grpc-1.41.1-3.oe2203.x86_64 http-parser-2.9.4-1.eulerosv2r11.x86_64 keyutils-libs-1.6.3-3.h3.eulerosv2r11.x86_64 krb5-libs-1.19.2-2.h8.eulerosv2r11.x86_64 lcr-2.0.7-2.h8.eulerosv2r11.x86_64 libacl-2.3.1-1.h1.eulerosv2r11.x86_64 libarchive-3.5.2-1.h2.eulerosv2r11.x86_64 libcap-2.61-1.h1.eulerosv2r11.x86_64 libcurl-7.79.1-2.h6.eulerosv2r11.x86_64 libgcc-10.3.1-10.h13.eulerosv2r11.x86_64 libgcrypt-1.9.4-1.h4.eulerosv2r11.x86_64 libidn2-2.3.2-2.h4.eulerosv2r11.x86_64 libnghttp2-1.46.0-1.h1.eulerosv2r11.x86_64 libpsl-0.21.1-4.h3.eulerosv2r11.x86_64 libselinux-3.3-1.h1.eulerosv2r11.x86_64 libsepol-3.3-2.h2.eulerosv2r11.x86_64 libssh-0.9.6-2.h6.eulerosv2r11.x86_64 libstdc++-10.3.1-10.h13.eulerosv2r11.x86_64 libwebsockets-4.3.0-2.h5.eulerosv2r11.x86_64 lz4-1.9.3-2.h1.eulerosv2r11.x86_64 openldap-2.6.0-2.h8.eulerosv2r11.x86_64 openssl-libs-1.1.1m-2.h17.eulerosv2r11.x86_64 pcre2-10.39-1.h3.eulerosv2r11.x86_64 re2-20211101-1.eulerosv2r11.x86_64 systemd-libs-249-16.h32.eulerosv2r11.x86_64 xz-libs-5.2.5-2.h1.eulerosv2r11.x86_64 zlib-1.2.11-19.h4.eulerosv2r11.x86_64 zstd-1.5.0-1.eulerosv2r11.x86_64
(gdb) bt
#0  memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/src/debug/yajl-2.1.0-15.h2.eulerosv2r11.x86_64/src/yajl.c:69
#1  yajl_alloc (callbacks=callbacks@entry=0x7fd90fe49ca0 <callbacks>, afs=0x7ffc601be840, afs@entry=0x0, ctx=ctx@entry=0x7ffc601be8a0)
    at /usr/src/debug/yajl-2.1.0-15.h2.eulerosv2r11.x86_64/src/yajl.c:67
#2  0x00007fd90fe46997 in yajl_tree_parse (
    input=0x55b9216f8ac0 "{\n    \"group\": \"isula\",\n    \"default-runtime\": \"lcr\",\n    \"graph\": \"/var/lib/isulad\",\n    \"state\": \"/var/run/isulad\",\n    \"engine\": \"lcr\",\n    \"log-level\": \"ERROR\",\n    \"pidfile\": \"/var/run/isulad.pid"..., error_buffer=0x7ffc601be910 "",
    error_buffer_size=1024) at /usr/src/debug/yajl-2.1.0-15.h2.eulerosv2r11.x86_64/src/yajl_tree.c:432
#3  0x00007fd910c1dc74 in isulad_daemon_configs_parse_data () from /usr/lib64/libisula_libutils.so
#4  0x00007fd910c1dd57 in isulad_daemon_configs_parse_file () from /usr/lib64/libisula_libutils.so
#5  0x000055b920d060bd in merge_json_confs_into_global (args=args@entry=0x55b9216f2b00)
    at /usr/src/debug/iSulad-2.0.11-6.h37.eulerosv2r11.x86_64/src/daemon/config/isulad_config.c:1523
#6  0x000055b920a87044 in server_conf_parse_save (argv=0x7ffc601bf218, argc=1)
    at /usr/src/debug/iSulad-2.0.11-6.h37.eulerosv2r11.x86_64/src/cmd/isulad/main.c:1067
#7  pre_init_daemon (msg=0x7ffc601bee30, argv=0x7ffc601bf218, argc=1)
    at /usr/src/debug/iSulad-2.0.11-6.h37.eulerosv2r11.x86_64/src/cmd/isulad/main.c:1545
#8  main (argc=1, argv=0x7ffc601bf218) at /usr/src/debug/iSulad-2.0.11-6.h37.eulerosv2r11.x86_64/src/cmd/isulad/main.c:1627
```
【预期结果】
不发生Segmentation fault.
【实际结果】
Program terminated with signal SIGSEGV, Segmentation fault.
【附件信息】
![输入图片说明](https://foruda.gitee.com/images/1662369149354497213/8f3536f9_9521463.png "屏幕截图")
hand未判空导致memcpy失败

src-openEuler/yajl

内容风险标识

评论 (3)

src-openEuler/yajl .gitee-modal { width: 500px !important; }

内容风险标识