silverf0x / RpcView

RpcView is a free tool to explore and decompile Microsoft RPC interfaces
GNU General Public License v3.0
895 stars 247 forks source link

RpcCore/RpcCore.c GetRpcServerAddressInProcess, potential null pointer dereference #30

Closed hfiref0x closed 5 years ago

hfiref0x commented 5 years ago

There is a potential null pointer dereference in RpcCore/RpcCore.c GetRpcServerAddressInProcess function.

The result of malloc call is not validated. https://github.com/silverf0x/RpcView/blob/c108da277be48accb3c6aaeb4af752a2028069bf/RpcCore/RpcCore.c#L228

In MS runtime malloc return NULL if call was unsuccessful (https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/malloc?view=vs-2017)

In case of failure null pointer will be dereferenced next.

I've checked all malloc calls in this project and they check return value like 50/50.

Identical issue located in RpcView/RpcView.cpp wWinMain. The argv variable is not checked if it was allocated, dereferenced and then argv[i] not checked if it was allocated and dererenced.

While memory allocation failure could be a super extra rare case and probably most of other code will fail to run in that case too, I think it is still good to have things handled.