Skip to content

Commit 942f5fb

Browse files
committed
Correctly handle null check of entry_data_list
I suspect at some point, we were passing in `entry_data_list` as a `MMDB_entry_data_list_s *`, which is what we do in other extensions, but that was refactored to `MMDB_entry_data_list_s **` for reasons I do not recall, and the loop check was never updated appropriately. This never caused an actual issue as we also have the size check. However, it could potentially lead to a segfault on a corrupt or otherwise invalid database.
1 parent b372324 commit 942f5fb

File tree

2 files changed

+4
-8
lines changed

2 files changed

+4
-8
lines changed

HISTORY.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ History
1111
* The vendored ``libmaxminddb`` has been updated to 1.12.2.
1212
* The C extension now checks that the database metadata lookup was
1313
successful.
14+
* A theoretical segmentation fault with the C extension when doing lookups
15+
on a corrupt or invalid database was fixed.
1416

1517
2.6.3 (2025-01-09)
1618
++++++++++++++++++

extension/maxminddb.c

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -751,10 +751,7 @@ static PyObject *from_map(MMDB_entry_data_list_s **entry_data_list) {
751751
const uint32_t map_size = (*entry_data_list)->entry_data.data_size;
752752

753753
uint32_t i;
754-
// entry_data_list cannot start out NULL (see from_entry_data_list). We
755-
// check it in the loop because it may become NULL.
756-
// coverity[check_after_deref]
757-
for (i = 0; i < map_size && entry_data_list; i++) {
754+
for (i = 0; i < map_size && *entry_data_list; i++) {
758755
*entry_data_list = (*entry_data_list)->next;
759756

760757
PyObject *key = PyUnicode_FromStringAndSize(
@@ -792,10 +789,7 @@ static PyObject *from_array(MMDB_entry_data_list_s **entry_data_list) {
792789
}
793790

794791
uint32_t i;
795-
// entry_data_list cannot start out NULL (see from_entry_data_list). We
796-
// check it in the loop because it may become NULL.
797-
// coverity[check_after_deref]
798-
for (i = 0; i < size && entry_data_list; i++) {
792+
for (i = 0; i < size && *entry_data_list; i++) {
799793
*entry_data_list = (*entry_data_list)->next;
800794
PyObject *value = from_entry_data_list(entry_data_list);
801795
if (value == NULL) {

0 commit comments

Comments
 (0)