View Issue Details

IDProjectCategoryView StatusLast Update
0009637GNUnetARM servicepublic2025-03-20 19:43
Reporterfefe Assigned ToChristian Grothoff  
PrioritynormalSeverityminorReproducibilityunable to reproduce
Status resolvedResolutionfixed 
Product VersionGit master 
Target Version0.24.1Fixed in Version0.25.0 
Summary0009637: process_refunds_cb: can prd->cr_head be NULL?
DescriptionThe case is handled by the for loop:

  503 for (cr = prd->cr_head;
  504 NULL != cr;
  505 cr = cr->next)
  506 if (cr->refund_serial == refund_serial)
  507 return;

but further down we just dereference cr_head->prev:

  523 GNUNET_CONTAINER_DLL_insert (prd->cr_head,
  524 prd->cr_tail,
  525 cr);
TagsNo tags attached.

Activities

Christian Grothoff

2025-03-19 02:11

manager   ~0024241

Nope, we don't. You're reading the macro wrong. It checks if cr_head is NULL. Our DLLs always work like that, basically head/tail start out as NULL, that's totally normal for that macro.

fefe

2025-03-19 10:23

reporter   ~0024242

I analyzed the issue a bit more.
This confused the static analyzer because it does not understand that head and tail are NULL at the same time.
You check whether tail is NULL and then dereference head->prev.
Adding an assertion that either both or none of head and tail are NULL would fix this.

Christian Grothoff

2025-03-19 12:25

manager   ~0024243

Fixed in GNUnet via 611583c70..db8b6c7a5.

Issue History

Date Modified Username Field Change
2025-03-18 14:51 fefe New Issue
2025-03-18 14:51 fefe Status new => assigned
2025-03-18 14:51 fefe Assigned To => Christian Grothoff
2025-03-19 02:11 Christian Grothoff Note Added: 0024241
2025-03-19 02:11 Christian Grothoff Status assigned => resolved
2025-03-19 02:11 Christian Grothoff Resolution open => no change required
2025-03-19 02:11 Christian Grothoff Fixed in Version => 1.0
2025-03-19 02:11 Christian Grothoff Reproducibility have not tried => unable to reproduce
2025-03-19 02:11 Christian Grothoff Product Version => git (master)
2025-03-19 02:11 Christian Grothoff Target Version => 1.0
2025-03-19 10:23 fefe Status resolved => feedback
2025-03-19 10:23 fefe Resolution no change required => reopened
2025-03-19 10:23 fefe Note Added: 0024242
2025-03-19 12:25 Christian Grothoff Note Added: 0024243
2025-03-19 12:25 Christian Grothoff Status feedback => resolved
2025-03-19 12:25 Christian Grothoff Resolution reopened => fixed
2025-03-19 12:25 Christian Grothoff Project Taler => GNUnet
2025-03-19 12:25 Christian Grothoff Category mechant backend => General
2025-03-19 12:26 Christian Grothoff Category General => ARM service
2025-03-19 12:26 Christian Grothoff Product Version git (master) => Git master
2025-03-19 12:26 Christian Grothoff Fixed in Version 1.0 => 0.25.0
2025-03-19 12:26 Christian Grothoff Target Version 1.0 => 0.25.0
2025-03-20 19:43 schanzen Target Version 0.25.0 => 0.24.1