diff mbox series

Prevent a short allocation by checking upper_length

Message ID lvq5tor4tudvh4xtxy47p3cescldr3v5c3fijgrqwkdfrktq5g@ycqxblnjgbaj (mailing list archive)
State Superseded
Headers show
Series Prevent a short allocation by checking upper_length | expand

Commit Message

Colin Wee May 3, 2024, 9:58 p.m. UTC
Hey Connman Maintainers,

I'd like to submit a patch fixing potential memory corruption in
connman. I've attached it for review, please let me know what you think.

-Colin

Comments

Marcel Holtmann May 8, 2024, 3:47 p.m. UTC | #1
Hi Colin,

> I'd like to submit a patch fixing potential memory corruption in
> connman. I've attached it for review, please let me know what you think.

we prefer inline patches for easier review. Best works a combination
git format-patch and then git-send-email.

Can you also please have a human behind the author name and email
address since we don’t accept patches from mailing list or aliases.

Regards

Marcel
Colin Wee May 10, 2024, 11:41 p.m. UTC | #2
Sure thing! I've updated the patch, let me know how else I can help.

-Colin
Colin Wee May 10, 2024, 11:51 p.m. UTC | #3
Sure thing! I've updated the patch, let me know how else I can help.

-Colin
Colin Wee May 10, 2024, 11:53 p.m. UTC | #4
Sure thing! I've updated the patch, let me know how else I can help.

-Colin
diff mbox series

Patch

From c9452e34e45be8b54fac0996464f4a5487799377 Mon Sep 17 00:00:00 2001
From: Tesla OpenSource <opensource@tesla.com>
Date: Fri, 3 May 2024 14:50:22 -0700
Subject: [PATCH] Prevent a short allocation by checking upper_length

---
 gdhcp/client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gdhcp/client.c b/gdhcp/client.c
index 2afa19e6..c9234a18 100644
--- a/gdhcp/client.c
+++ b/gdhcp/client.c
@@ -1863,6 +1863,8 @@  static char *malloc_option_value_string(uint8_t *option, GDHCPOptionType type)
 		return NULL;
 	upper_length = len_of_option_as_string[type] *
 			((unsigned)len / (unsigned)optlen);
+	if (upper_length == 0)
+		return NULL;
 	dest = ret = g_malloc(upper_length + 1);
 	if (!ret)
 		return NULL;
-- 
2.45.0