From 3fd6774633d05850de78cc9c095f377e922609ac Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 28 Mar 2026 21:19:14 +0000 Subject: [PATCH] networkd-ndisc: add assert for DNSSL allocation overflow safety Coverity flags ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1 as a potential overflow. Domain names are protocol-bounded but add an assert to make this explicit for static analyzers. CID#1548066 Follow-up for 1e7a0e21c97ac1bbc743009e5ec8c12bc6200e19 --- src/network/networkd-ndisc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c index 93965f5253..e6b03c0826 100644 --- a/src/network/networkd-ndisc.c +++ b/src/network/networkd-ndisc.c @@ -1909,6 +1909,8 @@ static int ndisc_router_process_dnssl(Link *link, sd_ndisc_router *rt, bool zero _cleanup_free_ NDiscDNSSL *s = NULL; NDiscDNSSL *dnssl; + /* Silence static analyzers */ + assert(strlen(*j) <= SIZE_MAX - ALIGN(sizeof(NDiscDNSSL)) - 1); s = malloc0(ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1); if (!s) return log_oom();