naccyde / rpms / iproute

Forked from rpms/iproute 10 months ago
Clone

Blame SOURCES/0102-tc-q_netem-Don-t-dereference-possibly-NULL-pointer.patch

99be8f
From a7329f9d8681bdbd2d8257b152ae6b4959232e67 Mon Sep 17 00:00:00 2001
99be8f
From: Andrea Claudi <aclaudi@redhat.com>
99be8f
Date: Mon, 29 Apr 2019 20:08:08 +0200
99be8f
Subject: [PATCH] tc/q_netem: Don't dereference possibly NULL pointer
99be8f
99be8f
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1465646
99be8f
Upstream Status: iproute2.git commit a754de3ccd937
99be8f
99be8f
commit a754de3ccd937500940c6fcd0ad043855f56862d
99be8f
Author: Phil Sutter <phil@nwl.cc>
99be8f
Date:   Thu Aug 24 11:46:32 2017 +0200
99be8f
99be8f
    tc/q_netem: Don't dereference possibly NULL pointer
99be8f
99be8f
    Assuming 'opt' might be NULL, move the call to RTA_PAYLOAD to after the
99be8f
    check since it dereferences its parameter.
99be8f
99be8f
    Signed-off-by: Phil Sutter <phil@nwl.cc>
99be8f
---
99be8f
 tc/q_netem.c | 3 ++-
99be8f
 1 file changed, 2 insertions(+), 1 deletion(-)
99be8f
99be8f
diff --git a/tc/q_netem.c b/tc/q_netem.c
99be8f
index 0975ae111de97..5a9e747411e85 100644
99be8f
--- a/tc/q_netem.c
99be8f
+++ b/tc/q_netem.c
99be8f
@@ -538,7 +538,7 @@ static int netem_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
99be8f
 	int *ecn = NULL;
99be8f
 	struct tc_netem_qopt qopt;
99be8f
 	const struct tc_netem_rate *rate = NULL;
99be8f
-	int len = RTA_PAYLOAD(opt) - sizeof(qopt);
99be8f
+	int len;
99be8f
 	__u64 rate64 = 0;
99be8f
 
99be8f
 	SPRINT_BUF(b1);
99be8f
@@ -546,6 +546,7 @@ static int netem_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt)
99be8f
 	if (opt == NULL)
99be8f
 		return 0;
99be8f
 
99be8f
+	len = RTA_PAYLOAD(opt) - sizeof(qopt);
99be8f
 	if (len < 0) {
99be8f
 		fprintf(stderr, "options size error\n");
99be8f
 		return -1;
99be8f
-- 
d30c09
2.21.0
99be8f