NULL pointer dereference in parse_def()

[simon--taylor]

Describe the bug

In parse_def() from rrd_graph_helper.c the pointer returned by getFirstUnusedArgument() is dereferenced without checking for NULL (line 1268).

To Reproduce

Invalid input results in a crash instead of an error.

./rrdtool graph /tmp/example.png DEF

gives the following output when rrdtool is compiled with AddressSanitizer.

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2395504==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5614387199b7 bp 0x7ffd82f60b40 sp 0x7ffd82f5fa00 T0)
==2395504==The signal is caused by a READ memory access.
==2395504==Hint: address points to the zero page.
    #0 0x5614387199b7 in parse_def /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_graph_helper.c:1268
    #1 0x56143871f1f0 in rrd_graph_script /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_graph_helper.c:2016
    #2 0x56143870e911 in rrd_graph_v /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_graph.c:4789
    #3 0x56143870eead in rrd_graph /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_graph.c:4684
    #4 0x56143869cfb2 in HandleInputLine /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_tool.c:817
    #5 0x56143869d77d in main /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_tool.c:566
    #6 0x7ff46de27740  (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
    #7 0x7ff46de27878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
    #8 0x56143869a224 in _start (/home/simon/program_source/rrdtool/rrdtool-master/src/rrdtool+0x1d4224) (BuildId: 003e36b8f852f9af7dae474db2b3294fccd4e5f9)

==2395504==Register values:
rax = 0x0000000000000000  rbx = 0x0000000000000000  rcx = 0x00007ff46e21cfdb  rdx = 0x0000000000000000
rdi = 0x0000561438719a4c  rsi = 0x00007ffd82f5f9f0  rbp = 0x00007ffd82f60b40  rsp = 0x00007ffd82f5fa00
 r8 = 0x0000000000001000   r9 = 0x00007ff46dcd3000  r10 = 0x0000000000000001  r11 = 0x0000000000000206
r12 = 0x00005614388eaaa0  r13 = 0x00005614387eda40  r14 = 0x0000000000000000  r15 = 0x00000f7e8d2be400
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/simon/program_source/rrdtool/rrdtool-master/src/rrd_graph_helper.c:1268 in parse_def
==2395504==ABORTING

Environment

• Linux 7.0.10 x86_64
• glibc 2.43