diff options
| author | Dimitri Staessens <dimitri@ouroboros.rocks> | 2026-07-10 17:09:58 +0200 |
|---|---|---|
| committer | Sander Vrijders <sander@ouroboros.rocks> | 2026-07-19 11:44:34 +0200 |
| commit | 395c084c54bc57cad618aea430afd06ce24d356b (patch) | |
| tree | c06389b240a3c1d8401dc444a1d07605d90d0245 /src/ipcpd | |
| parent | 111f7de5f83159b95fa9eb17fe750c0536737cce (diff) | |
| download | ouroboros-395c084c54bc57cad618aea430afd06ce24d356b.tar.gz ouroboros-395c084c54bc57cad618aea430afd06ce24d356b.zip | |
ipcpd: Fix NULL deref in DHT cleanup
The dht_kv_find_node_rsp_msg function steals *contacts and NULLs it on
success. When the subsequent msg->val allocation fails in
dht_kv_find_value_rsp_msg(), the stolen contacts are freed along with
the message, and do_dht_kv_find_value_req() is left with contacts ==
NULL while n_contacts is still positive: its fail_vals loop then
dereferences NULL.
Found by clang static analyzer.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
Diffstat (limited to 'src/ipcpd')
| -rw-r--r-- | src/ipcpd/unicast/dir/dht.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/ipcpd/unicast/dir/dht.c b/src/ipcpd/unicast/dir/dht.c index 753d9a73..b17218c4 100644 --- a/src/ipcpd/unicast/dir/dht.c +++ b/src/ipcpd/unicast/dir/dht.c @@ -2954,7 +2954,7 @@ static dht_msg_t * do_dht_kv_find_value_req(const dht_find_req_msg_t * req) fail_msg: freebufs(vals, n_vals); fail_vals: - while (n_contacts-- > 0) + while (contacts != NULL && n_contacts-- > 0) dht_contact_msg__free_unpacked(contacts[n_contacts], NULL); free(contacts); |