From 395c084c54bc57cad618aea430afd06ce24d356b Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Fri, 10 Jul 2026 17:09:58 +0200 Subject: ipcpd: Fix NULL deref in DHT cleanup The dht_kv_find_node_rsp_msg function steals *contacts and NULLs it on success. When the subsequent msg->val allocation fails in dht_kv_find_value_rsp_msg(), the stolen contacts are freed along with the message, and do_dht_kv_find_value_req() is left with contacts == NULL while n_contacts is still positive: its fail_vals loop then dereferences NULL. Found by clang static analyzer. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/ipcpd/unicast/dir/dht.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ipcpd/unicast/dir/dht.c b/src/ipcpd/unicast/dir/dht.c index 753d9a73..b17218c4 100644 --- a/src/ipcpd/unicast/dir/dht.c +++ b/src/ipcpd/unicast/dir/dht.c @@ -2954,7 +2954,7 @@ static dht_msg_t * do_dht_kv_find_value_req(const dht_find_req_msg_t * req) fail_msg: freebufs(vals, n_vals); fail_vals: - while (n_contacts-- > 0) + while (contacts != NULL && n_contacts-- > 0) dht_contact_msg__free_unpacked(contacts[n_contacts], NULL); free(contacts); -- cgit v1.2.3