flex icon indicating copy to clipboard operation
flex copied to clipboard

A potential bug of null pointer dereference

Open ash1852 opened this issue 4 years ago • 0 comments

step 1 : In file flex/src/regex.c , function regmatch_dup line 76 : Select the true branch at this point (m->rm_eorm_so is true)

step 2 : In file flex/src/regex.c , function regmatch_dup line 85 : Return null to caller

step 3 : In file flex/src/filter.c , function filter_fix_linedirs line 354 : Function regmatch_dup executes and stores the return value to fname (fname can be null)

step 4 : In file flex/src/filter.c , function filter_fix_linedirs line 356 : fname is used as the 1st parameter in function strcmp (fname can be null)

ash1852 avatar Sep 25 '21 02:09 ash1852