radareorg / sdb

Simple and fast string based key-value database with support for arrays and json
https://www.radare.org/
MIT License
218 stars 62 forks source link

Null deref in sdb_exists() #182

Closed thestr4ng3r closed 5 years ago

thestr4ng3r commented 5 years ago

Happens when calling sdb_set() with an empty value, then sdb_exists() with the same key:

sdb_set(sdb, "letterexperiment", "", 0);
sdb_exists(sdb, "letterexperiment");

Example:

[florian@florian-desktop sdb-exists]$ cat main.c

#include <sdb.h>
#include <stdio.h>

int main()
{
    Sdb *sdb = sdb_new(NULL, NULL, 0);
    sdb_set(sdb, "insomnia", "zyglrox", 0);
    sdb_set(sdb, "letterexperiment", "", 0);
    printf("exists: %d\n", sdb_exists(sdb, "insomnia") ? 1 : 0);
    printf("exists: %d\n", sdb_exists(sdb, "light") ? 1 : 0);
    printf("exists: %d\n", sdb_exists(sdb, "letterexperiment") ? 1 : 0);
    return 0;
}
[florian@florian-desktop sdb-exists]$ gdb build/sdb_exists_test
(gdb) r
Starting program: /home/florian/dev/sdb-exists/build/sdb_exists_test 
exists: 1
exists: 0

Program received signal SIGSEGV, Segmentation fault.
sdb_exists (s=0x555555566260, key=0x555555560016 "letterexperiment") at ../subprojects/sdb/src/sdb.c:380
380         return *sdbkv_value (kv);
(gdb) bt
#0  sdb_exists (s=0x555555566260, key=0x555555560016 "letterexperiment") at ../subprojects/sdb/src/sdb.c:380
#1  0x000055555555543c in main () at ../main.c:12