From 2b8434ea4640454ff27e2312545c8f593681dd21 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Sat, 15 Dec 2018 00:45:46 +0100 Subject: [PATCH] systemd: network: don't return allocated buffer of zero length from deserialize_in_addrs() Imported from systemd: deserialize_in_addrs() allocates the buffer before trying to parse the IP address. Since a parsing error is silently ignored, the returned size might be zero. In such a case we shouldn't return any buffer. Anyway, there was no leak, because there are only two callers like r = deserialize_in_addrs(&lease->dns, dns); which both keep the unused buffer and later release it. Note that deserialize_in_addrs() doesn't free the pointer before reassigning the new output. The caller must take care to to pass "ret" with an allocated buffer that would be leaked when returning the result. https://github.com/systemd/systemd/commit/c24b68216222156a45c5a8a918e7a44c144e9555 --- src/systemd/src/libsystemd-network/network-internal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/systemd/src/libsystemd-network/network-internal.c b/src/systemd/src/libsystemd-network/network-internal.c index f03a30f4b3..cee1085312 100644 --- a/src/systemd/src/libsystemd-network/network-internal.c +++ b/src/systemd/src/libsystemd-network/network-internal.c @@ -456,7 +456,7 @@ int deserialize_in_addrs(struct in_addr **ret, const char *string) { size++; } - *ret = TAKE_PTR(addresses); + *ret = size > 0 ? TAKE_PTR(addresses) : NULL; return size; }