Description of problem:

Possibly null pointer dereference in clnt_raw_freeres() of /root/libtirpc-1.3.3/src/clnt_raw.c

 240 /* ARGSUSED */
 241 static bool_t
 242 clnt_raw_freeres(cl, xdr_res, res_ptr)
 243         CLIENT *cl;
 244         xdrproc_t xdr_res;
 245         void *res_ptr;
 246 {
 247         struct clntraw_private *clp = clntraw_private;
 248         XDR *xdrs = &clp->xdr_stream;    // << pointer clp could be NULL here
 249         bool_t rval;
 250
 251         mutex_lock(&clntraw_lock);
 252         if (clp == NULL) {
 253                 rval = (bool_t) RPC_FAILED;
 254                 mutex_unlock(&clntraw_lock);
 255                 return (rval);
 256         }
 257         mutex_unlock(&clntraw_lock);
 258         xdrs->x_op = XDR_FREE;
 259         return ((*xdr_res)(xdrs, res_ptr));
 260 }

captured from clang-static-analyzer

Since the mutex clntraw_lock exists in multiple functions, and the valid structure of clntraw_private is allocated in clnt_raw_create(), who shares the same mutex with clnt_raw_freeres(), if that function is invoked before clnt_raw_create() in parallel or serial manner, the dereference of clp could lead to a null pointer reference.

  76 /*
  77  * Create a client handle for memory based rpc.
  78  */
  79 CLIENT *
  80 clnt_raw_create(prog, vers)
  81         rpcprog_t prog;
  82         rpcvers_t vers;
  83 {
  84         struct clntraw_private *clp;
  85         struct rpc_msg call_msg;
  86         XDR *xdrs;
  87         CLIENT  *client;
  88
  89         mutex_lock(&clntraw_lock);
  90         clp = clntraw_private;
  91         if (clp == NULL) {
  92                 clp = (struct clntraw_private *)calloc(1, sizeof (*clp)); // clntraw_private allocated here
  93                 if (clp == NULL) {
  94                         mutex_unlock(&clntraw_lock);
  95                         return NULL;
  96                 }
  97                 if (__rpc_rawcombuf == NULL)
  98                         __rpc_rawcombuf =
  99                             (char *)calloc(UDPMSGSIZE, sizeof (char));
 100                 clp->_raw_buf = __rpc_rawcombuf;
 101                 clntraw_private = clp;
 102         }
 103         xdrs = &clp->xdr_stream;
 104         client = &clp->client_object;
-- snip --


Version-Release number of selected component (if applicable):
libtirpc-1.1.3.el9