From c24b68216222156a45c5a8a918e7a44c144e9555 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Sat, 15 Dec 2018 00:45:46 +0100 Subject: [PATCH] network: don't return allocated buffer of zero length from deserialize_in_addrs() deserialize_in_addrs() allocates the buffer before trying to parse the IP address. Since a parsing error is silently ignored, the returned size might be zero. In such a case we shouldn't return any buffer. Anyway, there was no leak, because there are only two callers like r = deserialize_in_addrs(&lease->dns, dns); which both keep the unused buffer and later release it. Note that deserialize_in_addrs() doesn't free the pointer before reassigning the new output. The caller must take care to to pass "ret" with an allocated buffer that would be leaked when returning the result. --- src/libsystemd-network/network-internal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libsystemd-network/network-internal.c b/src/libsystemd-network/network-internal.c index a0209caf3a..221c83df56 100644 --- a/src/libsystemd-network/network-internal.c +++ b/src/libsystemd-network/network-internal.c @@ -457,7 +457,7 @@ int deserialize_in_addrs(struct in_addr **ret, const char *string) { size++; } - *ret = TAKE_PTR(addresses); + *ret = size > 0 ? TAKE_PTR(addresses) : NULL; return size; }