diff options
| author | Dimitri Staessens <dimitri@ouroboros.rocks> | 2026-07-10 17:09:58 +0200 |
|---|---|---|
| committer | Sander Vrijders <sander@ouroboros.rocks> | 2026-07-19 11:44:34 +0200 |
| commit | 395c084c54bc57cad618aea430afd06ce24d356b (patch) | |
| tree | c06389b240a3c1d8401dc444a1d07605d90d0245 /irmd.conf.in | |
| parent | 111f7de5f83159b95fa9eb17fe750c0536737cce (diff) | |
| download | ouroboros-395c084c54bc57cad618aea430afd06ce24d356b.tar.gz ouroboros-395c084c54bc57cad618aea430afd06ce24d356b.zip | |
ipcpd: Fix NULL deref in DHT cleanup
The dht_kv_find_node_rsp_msg function steals *contacts and NULLs it on
success. When the subsequent msg->val allocation fails in
dht_kv_find_value_rsp_msg(), the stolen contacts are freed along with
the message, and do_dht_kv_find_value_req() is left with contacts ==
NULL while n_contacts is still positive: its fail_vals loop then
dereferences NULL.
Found by clang static analyzer.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
Diffstat (limited to 'irmd.conf.in')
0 files changed, 0 insertions, 0 deletions