From a7032da6bbe875596ea1cb348a747123cda7d408 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Mon, 7 Mar 2022 18:15:58 +0100 Subject: ipcpd: Fix memcpy with NULL in piggyback API If there is no piggyback data, memcpy was passed a NULL pointer in memcpy(buf, NULL, 0) calls, which is undefined behaviour. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/ipcpd/eth/eth.c | 6 ++++-- src/ipcpd/udp/main.c | 6 ++++-- src/ipcpd/unicast/fa.c | 6 ++++-- src/irmd/main.c | 8 +++++--- 4 files changed, 17 insertions(+), 9 deletions(-) diff --git a/src/ipcpd/eth/eth.c b/src/ipcpd/eth/eth.c index f62bd0a7..25f42fc8 100644 --- a/src/ipcpd/eth/eth.c +++ b/src/ipcpd/eth/eth.c @@ -496,7 +496,8 @@ static int eth_ipcp_alloc(const uint8_t * dst_addr, msg->timeout = hton32(qs.timeout); memcpy(msg + 1, hash, ipcp_dir_hash_len()); - memcpy(buf + len + ETH_HEADER_TOT_SIZE, data, dlen); + if (dlen > 0) + memcpy(buf + len + ETH_HEADER_TOT_SIZE, data, dlen); ret = eth_ipcp_send_frame(dst_addr, #if defined(BUILD_ETH_DIX) @@ -542,7 +543,8 @@ static int eth_ipcp_alloc_resp(uint8_t * dst_addr, #endif msg->response = response; - memcpy(msg + 1, data, len); + if (len > 0) + memcpy(msg + 1, data, len); if (eth_ipcp_send_frame(dst_addr, #if defined(BUILD_ETH_DIX) diff --git a/src/ipcpd/udp/main.c b/src/ipcpd/udp/main.c index 3b354ceb..7def856b 100644 --- a/src/ipcpd/udp/main.c +++ b/src/ipcpd/udp/main.c @@ -222,7 +222,8 @@ static int ipcp_udp_port_alloc(const struct sockaddr_in * r_saddr, msg->timeout = hton32(qs.timeout); memcpy(msg + 1, dst, ipcp_dir_hash_len()); - memcpy(buf + len, data, dlen); + if (dlen > 0) + memcpy(buf + len, data, dlen); if (sendto(udp_data.s_fd, msg, len + dlen, SENDTO_FLAGS, @@ -255,7 +256,8 @@ static int ipcp_udp_port_alloc_resp(const struct sockaddr_in * r_saddr, msg->d_eid = hton32(d_eid); msg->response = response; - memcpy(msg + 1, data, len); + if (len > 0) + memcpy(msg + 1, data, len); if (sendto(udp_data.s_fd, msg, sizeof(*msg) + len, SENDTO_FLAGS, diff --git a/src/ipcpd/unicast/fa.c b/src/ipcpd/unicast/fa.c index eb467a90..508f2d73 100644 --- a/src/ipcpd/unicast/fa.c +++ b/src/ipcpd/unicast/fa.c @@ -847,7 +847,8 @@ int fa_alloc(int fd, msg->timeout = hton32(qs.timeout); memcpy(msg + 1, dst, ipcp_dir_hash_len()); - memcpy(shm_du_buff_head(sdb) + len, data, dlen); + if (dlen > 0) + memcpy(shm_du_buff_head(sdb) + len, data, dlen); if (dt_write_packet(addr, qc, fa.eid, sdb)) { ipcp_sdb_release(sdb); @@ -897,7 +898,8 @@ int fa_alloc_resp(int fd, msg->s_eid = hton64(flow->s_eid); msg->response = response; - memcpy(msg + 1, data, len); + if (len > 0) + memcpy(msg + 1, data, len); if (response < 0) { fa_flow_fini(flow); diff --git a/src/irmd/main.c b/src/irmd/main.c index fdbc25a7..fab9497d 100644 --- a/src/irmd/main.c +++ b/src/irmd/main.c @@ -1698,8 +1698,8 @@ static int flow_req_arr(pid_t pid, } f->len = len; - - memcpy(f->data, data, len); + if (len > 0) + memcpy(f->data, data, len); } list_add(&f->next, &irmd.irm_flows); @@ -1764,7 +1764,9 @@ static int flow_alloc_reply(int flow_id, return -1; } - memcpy(f->data, data, len); + if (len > 0) + memcpy(f->data, data, len); + f->len = len; pthread_rwlock_unlock(&irmd.flows_lock); -- cgit v1.2.3