network: don't return allocated buffer of zero length from deserialize_in_addrs()
authorThomas Haller <thaller@redhat.com>
Fri, 14 Dec 2018 23:45:46 +0000 (00:45 +0100)
committerThomas Haller <thaller@redhat.com>
Mon, 18 Feb 2019 12:32:06 +0000 (13:32 +0100)
deserialize_in_addrs() allocates the buffer before trying to parse
the IP address. Since a parsing error is silently ignored, the returned
size might be zero. In such a case we shouldn't return any buffer.

Anyway, there was no leak, because there are only two callers like

    r = deserialize_in_addrs(&lease->dns, dns);

which both keep the unused buffer and later release it.

Note that deserialize_in_addrs() doesn't free the pointer before
reassigning the new output. The caller must take care to to pass
"ret" with an allocated buffer that would be leaked when returning
the result.

src/libsystemd-network/network-internal.c

index a0209ca..221c83d 100644 (file)
@@ -457,7 +457,7 @@ int deserialize_in_addrs(struct in_addr **ret, const char *string) {
                 size++;
         }
 
-        *ret = TAKE_PTR(addresses);
+        *ret = size > 0 ? TAKE_PTR(addresses) : NULL;
 
         return size;
 }