niansa-misc/musl
1
0
Fork 0
mirror of git://git.musl-libc.org/musl synced 2025-03-06 20:48:29 +01:00
Code Issues Projects Releases Packages Wiki Activity

getifaddrs: fix UB via taking address of null pointer union dereference

Browse source 
getifaddrs computes &ctx->first->ifa even if ctx->first is NULL. While
this shouldn't be possible on the success path because the loopback
interface is hardcoded into the kernel, this is still possible on the
error path (for example, if __rtnetlink_enumerate couldn't create a
socket due to exceeding the fd limit).
This commit is contained in:
Alexey Izbyshev 2023-02-27 23:05:16 +03:00 • committed by Rich Felker
parent c499c1084e
commit 1a708ece1a
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/network/getifaddrs.c
View file

@ -39,8 +39,8 @@ struct ifaddrs_storage {
};
struct ifaddrs_ctx {
struct ifaddrs_storage *first;
struct ifaddrs_storage *last;
struct ifaddrs *first;
struct ifaddrs *last;
struct ifaddrs_storage *hash[IFADDRS_HASH_SIZE];
};
@ -195,9 +195,9 @@ static int netlink_msg_to_ifaddr(void *pctx, struct nlmsghdr *h)
}
if (ifs->ifa.ifa_name) {
if (!ctx->first) ctx->first = ifs;
if (ctx->last) ctx->last->ifa.ifa_next = &ifs->ifa;
ctx->last = ifs;
if (!ctx->first) ctx->first = &ifs->ifa;
if (ctx->last) ctx->last->ifa_next = &ifs->ifa;
ctx->last = &ifs->ifa;
} else {
free(ifs);
}
@ -210,7 +210,7 @@ int getifaddrs(struct ifaddrs **ifap)
int r;
memset(ctx, 0, sizeof *ctx);
r = __rtnetlink_enumerate(AF_UNSPEC, AF_UNSPEC, netlink_msg_to_ifaddr, ctx);
if (r == 0) *ifap = &ctx->first->ifa;
else freeifaddrs(&ctx->first->ifa);
if (r == 0) *ifap = ctx->first;
else freeifaddrs(ctx->first);
return r;
}