diff mbox

[4/5] ipv6: Fix NULL pointer dereference in ip6addr_add()

Message ID 1462218931-4573-5-git-send-email-thuth@redhat.com
State Accepted
Headers show

Commit Message

Thomas Huth May 2, 2016, 7:55 p.m. UTC
When ip6addr_add() is called for the first time, both the first_ip6
and the last_ip6 pointer are not initialized yet, i.e. contain NULL.
So writing to "last_ip6->next" is a bad idea here. Fix it so that
this value is only written when the function is not called for the
first time.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 clients/net-snk/app/netlib/ipv6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Andrew Jones May 3, 2016, 5:32 a.m. UTC | #1
On Mon, May 02, 2016 at 09:55:30PM +0200, Thomas Huth wrote:
> When ip6addr_add() is called for the first time, both the first_ip6
> and the last_ip6 pointer are not initialized yet, i.e. contain NULL.
> So writing to "last_ip6->next" is a bad idea here. Fix it so that
> this value is only written when the function is not called for the
> first time.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>  clients/net-snk/app/netlib/ipv6.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Andrew Jones <drjones@redhat.com>

> 
> diff --git a/clients/net-snk/app/netlib/ipv6.c b/clients/net-snk/app/netlib/ipv6.c
> index 220fd36..6aa1ea3 100644
> --- a/clients/net-snk/app/netlib/ipv6.c
> +++ b/clients/net-snk/app/netlib/ipv6.c
> @@ -330,7 +330,8 @@ int8_t ip6addr_add(struct ip6addr_list_entry *new_address)
>  
>  	if (first_ip6 == NULL)
>  		first_ip6 = new_address;
> -	last_ip6->next = new_address;
> +	else
> +		last_ip6->next = new_address;
>  	last_ip6 = new_address;
>  	last_ip6->next = NULL;
>  
> -- 
> 1.8.3.1
>
diff mbox

Patch

diff --git a/clients/net-snk/app/netlib/ipv6.c b/clients/net-snk/app/netlib/ipv6.c
index 220fd36..6aa1ea3 100644
--- a/clients/net-snk/app/netlib/ipv6.c
+++ b/clients/net-snk/app/netlib/ipv6.c
@@ -330,7 +330,8 @@  int8_t ip6addr_add(struct ip6addr_list_entry *new_address)
 
 	if (first_ip6 == NULL)
 		first_ip6 = new_address;
-	last_ip6->next = new_address;
+	else
+		last_ip6->next = new_address;
 	last_ip6 = new_address;
 	last_ip6->next = NULL;