|
 |
4cfa1d |
From 8bb864ad6586da7767cf4b90b75e62cd7324859d Mon Sep 17 00:00:00 2001
|
|
|
4cfa1d |
From: Phil Sutter <psutter@redhat.com>
|
|
|
4cfa1d |
Date: Tue, 21 Feb 2023 19:50:41 +0100
|
|
|
4cfa1d |
Subject: [PATCH] netlink: Fix for potential NULL-pointer deref
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2160049
|
|
|
4cfa1d |
Upstream Status: nftables commit 927d5674e7bf6
|
|
|
4cfa1d |
|
|
|
4cfa1d |
commit 927d5674e7bf656428f97c54c9171006e8c3c75e
|
|
|
4cfa1d |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
4cfa1d |
Date: Tue Jan 10 22:36:58 2023 +0100
|
|
|
4cfa1d |
|
|
|
4cfa1d |
netlink: Fix for potential NULL-pointer deref
|
|
|
4cfa1d |
|
|
|
4cfa1d |
If memory allocation fails, calloc() returns NULL which was not checked
|
|
|
4cfa1d |
for. The code seems to expect zero array size though, so simply
|
|
|
4cfa1d |
replacing this call by one of the x*calloc() ones won't work. So guard
|
|
|
4cfa1d |
the call also by a check for 'len'.
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Fixes: db0697ce7f602 ("src: support for flowtable listing")
|
|
|
4cfa1d |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
4cfa1d |
|
|
|
4cfa1d |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
4cfa1d |
---
|
|
|
4cfa1d |
src/netlink.c | 3 ++-
|
|
|
4cfa1d |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
4cfa1d |
|
|
|
4cfa1d |
diff --git a/src/netlink.c b/src/netlink.c
|
|
|
4cfa1d |
index 799cf9b..dee1732 100644
|
|
|
4cfa1d |
--- a/src/netlink.c
|
|
|
4cfa1d |
+++ b/src/netlink.c
|
|
|
4cfa1d |
@@ -1700,7 +1700,8 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx,
|
|
|
4cfa1d |
while (dev_array[len])
|
|
|
4cfa1d |
len++;
|
|
|
4cfa1d |
|
|
|
4cfa1d |
- flowtable->dev_array = calloc(1, len * sizeof(char *));
|
|
|
4cfa1d |
+ if (len)
|
|
|
4cfa1d |
+ flowtable->dev_array = xmalloc(len * sizeof(char *));
|
|
|
4cfa1d |
for (i = 0; i < len; i++)
|
|
|
4cfa1d |
flowtable->dev_array[i] = xstrdup(dev_array[i]);
|
|
|
4cfa1d |
|
|
|
4cfa1d |
--
|
|
|
4cfa1d |
2.39.2
|
|
|
4cfa1d |
|