Prevent a short allocation by checking upper_length

Commit Message

Colin Wee May 3, 2024, 9:58 p.m. UTC

Hey Connman Maintainers,

I'd like to submit a patch fixing potential memory corruption in
connman. I've attached it for review, please let me know what you think.

-Colin

Comments

Marcel Holtmann May 8, 2024, 3:47 p.m. UTC | #1

Hi Colin,

> I'd like to submit a patch fixing potential memory corruption in
> connman. I've attached it for review, please let me know what you think.

we prefer inline patches for easier review. Best works a combination
git format-patch and then git-send-email.

Can you also please have a human behind the author name and email
address since we don’t accept patches from mailing list or aliases.

Regards

Marcel

Colin Wee May 10, 2024, 11:41 p.m. UTC | #2

Sure thing! I've updated the patch, let me know how else I can help.

-Colin

Colin Wee May 10, 2024, 11:51 p.m. UTC | #3

Sure thing! I've updated the patch, let me know how else I can help.

-Colin

Colin Wee May 10, 2024, 11:53 p.m. UTC | #4

Sure thing! I've updated the patch, let me know how else I can help.

-Colin

Patch

From c9452e34e45be8b54fac0996464f4a5487799377 Mon Sep 17 00:00:00 2001
From: Tesla OpenSource <[e-mail]>
Date: Fri, 3 May 2024 14:50:22 -0700
Subject: [PATCH] Prevent a short allocation by checking upper_length

---
 gdhcp/client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gdhcp/client.c b/gdhcp/client.c
index 2afa19e6..c9234a18 100644
--- a/gdhcp/client.c
+++ b/gdhcp/client.c
@@ -1863,6 +1863,8 @@  static char *malloc_option_value_string(uint8_t *option, GDHCPOptionType type)
 		return NULL;
 	upper_length = len_of_option_as_string[type] *
 			((unsigned)len / (unsigned)optlen);
+	if (upper_length == 0)
+		return NULL;
 	dest = ret = g_malloc(upper_length + 1);
 	if (!ret)
 		return NULL;
-- 
2.45.0