Date: Tue, 11 Aug 2015 17:54:52 +0000 (UTC) From: Mariusz Zaborski <oshogbo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r286644 - head/sys/contrib/libnv Message-ID: <201508111754.t7BHsqXb056144@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: oshogbo Date: Tue Aug 11 17:54:51 2015 New Revision: 286644 URL: https://svnweb.freebsd.org/changeset/base/286644 Log: Don't set parent if the unpack operation fail. In some case this could crash the library, because of the NULL pointer references. Discovered thanks to american fuzzy lop. Approved by: pjd (mentor) Modified: head/sys/contrib/libnv/nvlist.c Modified: head/sys/contrib/libnv/nvlist.c ============================================================================== --- head/sys/contrib/libnv/nvlist.c Tue Aug 11 17:48:58 2015 (r286643) +++ head/sys/contrib/libnv/nvlist.c Tue Aug 11 17:54:51 2015 (r286644) @@ -824,6 +824,8 @@ nvlist_xunpack(const void *buf, size_t s case NV_TYPE_NVLIST: ptr = nvpair_unpack_nvlist(isbe, nvp, ptr, &left, nfds, &tmpnvl); + if (tmpnvl == NULL || ptr == NULL) + goto failed; nvlist_set_parent(tmpnvl, nvp); break; #ifndef _KERNEL
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201508111754.t7BHsqXb056144>