printing SDR name from raw data will occur segfault if raw is NULL #84

answer_9030 commented 2026年05月12日 11:53:57 +02:00

The call stack of the coredump file is shown in the following figure:

Core was generated by `ipmitool -v sdr list'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 ipmi_sdr_print_name_from_rawentry (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, id=<optimized out>, type=<optimized out>, raw=0x0) at ipmi_sdr.c:2529
2529	ipmi_sdr.c: 没有那个文件或目录.
(gdb) bt
#0 ipmi_sdr_print_name_from_rawentry (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, id=<optimized out>, type=<optimized out>, raw=0x0) at ipmi_sdr.c:2529
#1 0x0000aaaea81903b8 in sdrr_get_records (queue=<synthetic pointer>, itr=0xaaaedb5e5ac0, intf=0xaaaea823c988 <ipmi_open_intf>) at ipmi_sdradd.c:266
#2 sdr_copy_to_sdrr (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, use_builtin=use_builtin@entry=1, from_addr=from_addr@entry=32, 
 to_addr=to_addr@entry=32) at ipmi_sdradd.c:297
#3 0x0000aaaea81904f8 in ipmi_sdr_add_from_sensors (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, maxslot=maxslot@entry=0) at ipmi_sdradd.c:329
#4 0x0000aaaea8153558 in ipmi_sdr_start (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, use_builtin=use_builtin@entry=0) at ipmi_sdr.c:2952
#5 0x0000aaaea8153c4c in ipmi_sdr_print_sdr (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, type=<optimized out>) at ipmi_sdr.c:2704
#6 0x0000aaaea8155df4 in ipmi_sdr_main (intf=0xaaaea823c988 <ipmi_open_intf>, argc=<optimized out>, argv=0xffffe9587550) at ipmi_sdr.c:4694
#7 0x0000aaaea8185ebc in ipmi_main (argc=4, argv=<optimized out>, cmdlist=0x0, intflist=0x0) at ipmi_main.c:1010
#8 0x0000aaaea814ba68 in main (argc=<optimized out>, argv=<optimized out>) at ipmitool.c:134

The code is shown in the following figure:

 2505 int
 2506 ipmi_sdr_print_name_from_rawentry(struct ipmi_intf *intf, uint16_t id,
 2507 uint8_t type, uint8_t *raw)
 2508 {
 2509 union {
 2510 struct sdr_record_full_sensor *full;
 2511 struct sdr_record_compact_sensor *compact;
 2512 struct sdr_record_eventonly_sensor *eventonly;
 2513 struct sdr_record_generic_locator *genloc;
 2514 struct sdr_record_fru_locator *fruloc;
 2515 struct sdr_record_mc_locator *mcloc;
 2516 struct sdr_record_entity_assoc *entassoc;
 2517 struct sdr_record_oem *oem;
 2518 } record;
 2519 
 2520 int rc =0;
 2521 char desc[17];
 2522 const char *id_string;
 2523 uint8_t id_code;
 2524 memset(desc, ' ', sizeof (desc));
 2525 
 2526 switch ( type) {
 2527 case SDR_RECORD_TYPE_FULL_SENSOR:
 2528 record.full = (struct sdr_record_full_sensor *) raw;
 2529 id_code = record.full->id_code;
 2530 id_string = record.full->id_string;
 2531 break;
 2532 
 2533 case SDR_RECORD_TYPE_COMPACT_SENSOR:
 2534 record.compact = (struct sdr_record_compact_sensor *) raw ;
 2535 id_code = record.compact->id_code;
 2536 id_string = record.compact->id_string;
 2537 break;
 2538 
 2539 case SDR_RECORD_TYPE_EVENTONLY_SENSOR:
 2540 record.eventonly = (struct sdr_record_eventonly_sensor *) raw ;
 2541 id_code = record.eventonly->id_code;
 2542 id_string = record.eventonly->id_string;
 2543 break;
 2544 
 2545 case SDR_RECORD_TYPE_MC_DEVICE_LOCATOR:
 2546 record.mcloc = (struct sdr_record_mc_locator *) raw ;
 2547 id_code = record.mcloc->id_code;
 2548 id_string = record.mcloc->id_string;
 2549 break;
 2550 
 2551 default:
 2552 rc = -1;
 2553 }
 2554 if (!rc) {
 2555 snprintf(desc, sizeof(desc), "%.*s", (id_code & 0x1f) + 1, id_string);
 2556 }
 2557 
 2558 lprintf(LOG_INFO, "ID: 0x%04x , NAME: %-16s", id, desc);
 2559 return rc;
 2560 }

The call stack of the coredump file is shown in the following figure: ``` Core was generated by `ipmitool -v sdr list'. Program terminated with signal SIGSEGV, Segmentation fault. #0 ipmi_sdr_print_name_from_rawentry (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, id=<optimized out>, type=<optimized out>, raw=0x0) at ipmi_sdr.c:2529 2529 ipmi_sdr.c: 没有那个文件或目录. (gdb) bt #0 ipmi_sdr_print_name_from_rawentry (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, id=<optimized out>, type=<optimized out>, raw=0x0) at ipmi_sdr.c:2529 #1 0x0000aaaea81903b8 in sdrr_get_records (queue=<synthetic pointer>, itr=0xaaaedb5e5ac0, intf=0xaaaea823c988 <ipmi_open_intf>) at ipmi_sdradd.c:266 #2 sdr_copy_to_sdrr (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, use_builtin=use_builtin@entry=1, from_addr=from_addr@entry=32, to_addr=to_addr@entry=32) at ipmi_sdradd.c:297 #3 0x0000aaaea81904f8 in ipmi_sdr_add_from_sensors (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, maxslot=maxslot@entry=0) at ipmi_sdradd.c:329 #4 0x0000aaaea8153558 in ipmi_sdr_start (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, use_builtin=use_builtin@entry=0) at ipmi_sdr.c:2952 #5 0x0000aaaea8153c4c in ipmi_sdr_print_sdr (intf=intf@entry=0xaaaea823c988 <ipmi_open_intf>, type=<optimized out>) at ipmi_sdr.c:2704 #6 0x0000aaaea8155df4 in ipmi_sdr_main (intf=0xaaaea823c988 <ipmi_open_intf>, argc=<optimized out>, argv=0xffffe9587550) at ipmi_sdr.c:4694 #7 0x0000aaaea8185ebc in ipmi_main (argc=4, argv=<optimized out>, cmdlist=0x0, intflist=0x0) at ipmi_main.c:1010 #8 0x0000aaaea814ba68 in main (argc=<optimized out>, argv=<optimized out>) at ipmitool.c:134 ``` The code is shown in the following figure: ``` 2505 int 2506 ipmi_sdr_print_name_from_rawentry(struct ipmi_intf *intf, uint16_t id, 2507 uint8_t type, uint8_t *raw) 2508 { 2509 union { 2510 struct sdr_record_full_sensor *full; 2511 struct sdr_record_compact_sensor *compact; 2512 struct sdr_record_eventonly_sensor *eventonly; 2513 struct sdr_record_generic_locator *genloc; 2514 struct sdr_record_fru_locator *fruloc; 2515 struct sdr_record_mc_locator *mcloc; 2516 struct sdr_record_entity_assoc *entassoc; 2517 struct sdr_record_oem *oem; 2518 } record; 2519 2520 int rc =0; 2521 char desc[17]; 2522 const char *id_string; 2523 uint8_t id_code; 2524 memset(desc, ' ', sizeof (desc)); 2525 2526 switch ( type) { 2527 case SDR_RECORD_TYPE_FULL_SENSOR: 2528 record.full = (struct sdr_record_full_sensor *) raw; 2529 id_code = record.full->id_code; 2530 id_string = record.full->id_string; 2531 break; 2532 2533 case SDR_RECORD_TYPE_COMPACT_SENSOR: 2534 record.compact = (struct sdr_record_compact_sensor *) raw ; 2535 id_code = record.compact->id_code; 2536 id_string = record.compact->id_string; 2537 break; 2538 2539 case SDR_RECORD_TYPE_EVENTONLY_SENSOR: 2540 record.eventonly = (struct sdr_record_eventonly_sensor *) raw ; 2541 id_code = record.eventonly->id_code; 2542 id_string = record.eventonly->id_string; 2543 break; 2544 2545 case SDR_RECORD_TYPE_MC_DEVICE_LOCATOR: 2546 record.mcloc = (struct sdr_record_mc_locator *) raw ; 2547 id_code = record.mcloc->id_code; 2548 id_string = record.mcloc->id_string; 2549 break; 2550 2551 default: 2552 rc = -1; 2553 } 2554 if (!rc) { 2555 snprintf(desc, sizeof(desc), "%.*s", (id_code & 0x1f) + 1, id_string); 2556 } 2557 2558 lprintf(LOG_INFO, "ID: 0x%04x , NAME: %-16s", id, desc); 2559 return rc; 2560 } ```