Bug 15601 - DIVISION_BY_ZERO in /source3/modules/vfs_fruit.c
Summary: DIVISION_BY_ZERO in /source3/modules/vfs_fruit.c
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.16.11
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
Depends on:
Reported: 2024-03-06 18:01 UTC by e.bykhanova@fobos-nt.ru
Modified: 2024-03-06 18:01 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description e.bykhanova@fobos-nt.ru 2024-03-06 18:01:32 UTC
The static analyzer has detected DIVISION_BY_ZERO: variable nbands, whose possible value set allows a zero value at vfs_fruit.c:5191, is used as a denominator at vfs_fruit.c:5261.

The potentially null divisor `nbands` is initialized at vfs_fruit.c:5244:
`ok = fruit_get_num_bands(handle, name, &nbands);`

We see (at vfs_fruit.c:5191-5208) that `nbands`'s value increases (it's initial value zero) at least once in `while`-loop (vfs_fruit.c:5193-5200).

`while`-loop will be executed if:
1) function `Readername` returns `!=NULL`-value
2) `if (ISDOT(dname) || ISDOTDOT(dname))`-condition is true (vfs_fruit.c:5196).

If code at source3/smbd/dir.c:1614-1626 is executed then condition 2) `if (ISDOT(dname) || ISDOTDOT(dname))` is true.

However, if the directory is empty (has nothing except "." and "..") (though this contradicts the logic of the program) then `nbanks` will never increases and we will get a `division by zero`-error.

We created this issue to check with the developers if such situation (an empty dir entailing div by zero) is possible.

1) vfs_fruit.c:5191
2) vfs_fruit.c:5193-5200
3) source3/smbd/dir/c:1614-1626

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.

Author E. Bykhanova (e.bykhanova@fobos-nt.ru).