| Message ID | 20240510235325.3625167-2-cwee@tesla.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 281e352c4c4355dd6b8ad927feaa0a255ed6f63f |
| Headers | show |
| Series | Prevent a short allocation by checking upper_length | expand |
Hey Marcel / Connman team, Just wanted to check in here. Have you had a chance to review this patch? -Colin On Fri, May 10, 2024 at 04:53:16PM GMT, Colin Wee wrote: > From: Craig Young <cryoung@tesla.com> > > --- > gdhcp/client.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/gdhcp/client.c b/gdhcp/client.c > index 2afa19e6..c9234a18 100644 > --- a/gdhcp/client.c > +++ b/gdhcp/client.c > @@ -1863,6 +1863,8 @@ static char *malloc_option_value_string(uint8_t *option, GDHCPOptionType type) > return NULL; > upper_length = len_of_option_as_string[type] * > ((unsigned)len / (unsigned)optlen); > + if (upper_length == 0) > + return NULL; > dest = ret = g_malloc(upper_length + 1); > if (!ret) > return NULL; > -- > 2.45.0
Hi Craig, On 5/10/24 6:53 PM, Colin Wee wrote: > From: Craig Young <cryoung@tesla.com> > > --- > gdhcp/client.c | 2 ++ > 1 file changed, 2 insertions(+) > I added a gdhcp: prefix to the commit subject. Applied, thanks. If you have other fixes, feel free to send these in. Regards, -Denis
Hello: This patch was applied to connman.git (master) by Denis Kenzior <denkenz@gmail.com>: On Fri, 10 May 2024 23:53:30 +0000 you wrote: > From: Craig Young <cryoung@tesla.com> > > --- > gdhcp/client.c | 2 ++ > 1 file changed, 2 insertions(+) Here is the summary with links: - Prevent a short allocation by checking upper_length https://git.kernel.org/pub/scm/network/connman/connman.git/?id=281e352c4c43 You are awesome, thank you!
diff --git a/gdhcp/client.c b/gdhcp/client.c index 2afa19e6..c9234a18 100644 --- a/gdhcp/client.c +++ b/gdhcp/client.c @@ -1863,6 +1863,8 @@ static char *malloc_option_value_string(uint8_t *option, GDHCPOptionType type) return NULL; upper_length = len_of_option_as_string[type] * ((unsigned)len / (unsigned)optlen); + if (upper_length == 0) + return NULL; dest = ret = g_malloc(upper_length + 1); if (!ret) return NULL;
From: Craig Young <cryoung@tesla.com> --- gdhcp/client.c | 2 ++ 1 file changed, 2 insertions(+)