[LU-6542] cYAML_build_error ignores NULL itm pointer on cYAML_create_object call

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.8.0
• Environment: Ubuntu 15.04
• Severity: 3
• Assignee: Amir Shehata (Inactive)
• Reporter: Colin Ian King

Description

Static analysis picked up a potential issue in cYAML_build_error() in lnet/utils/cyaml/cyaml.c :

/* look for the command */
cmd_obj = cYAML_get_object_item(r, (const char *)cmd);
if (cmd_obj != NULL && cmd_obj->cy_type == CYAML_TYPE_ARRAY)
itm = cYAML_create_seq_item(cmd_obj);
else if (cmd_obj == NULL)

{ s = cYAML_create_seq(r, cmd); itm = cYAML_create_seq_item(s); }

else if (cmd_obj != NULL && cmd_obj->cy_type != CYAML_TYPE_ARRAY)
goto failed;

err = cYAML_create_object(itm, entity);
if (err == NULL)
goto failed;

From what I can see, cYAML_create_seq_item() has the potential of returning NULL on the tm = cYAML_create_seq_item(cmd_obj) assignments. Later, the err = cYAML_create_object(itm, entity) statement could pass a NULL itm and this calls insert_item() and then cYAML_insert_child() with a NULL parent which silently ignores the NULL parent insert and the original caller gets to cYAML_create_object() has no error return informing it that the insert failed to be actioned. I think some kind of error handling on itm being NULL should be performed rather than silently ignore it.