status-im
/
miniupnp
mirror of https://github.com/status-im/miniupnp.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix SEGV issue (due to invalid memory alloc case).

This commit is contained in:
Tomofumi Hayashi 2015-04-28 17:02:03 +09:00
parent 101c443192
commit 7948b7d754
2 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
miniupnpd/netfilter_nft/nftnlrdr.c
View File

@ -201,6 +201,10 @@ get_peer_rule_by_index(int index,
printf("get_peer_rule_by_index()\n"); printf("get_peer_rule_by_index()\n");
reflesh_nft_cache(NFPROTO_IPV4); reflesh_nft_cache(NFPROTO_IPV4);
if (peer_cache == NULL) {
return -1;
}
for (i = 0; peer_cache[i] != NULL; i++) { for (i = 0; peer_cache[i] != NULL; i++) {
if (index == i) { if (index == i) {
r = peer_cache[i]; r = peer_cache[i];
@ -283,6 +287,10 @@ get_redirect_rule_by_index(int index,
printf("get_redirect_rule_by_index()\n"); printf("get_redirect_rule_by_index()\n");
reflesh_nft_cache(NFPROTO_IPV4); reflesh_nft_cache(NFPROTO_IPV4);
if (redirect_cache == NULL) {
return -1;
}
for (i = 0; redirect_cache[i] != NULL; i++) { for (i = 0; redirect_cache[i] != NULL; i++) {
if (index == i) { if (index == i) {
r = redirect_cache[i]; r = redirect_cache[i];

20
miniupnpd/netfilter_nft/nftnlrdr_misc.c
View File

@ -550,8 +550,15 @@ reflesh_nft_redirect_cache(void)
int i; int i;
uint32_t len; uint32_t len;
free(redirect_cache); if (redirect_cache != NULL) {
free(redirect_cache);
}
len = rule_list_length - rule_list_peer_length; len = rule_list_length - rule_list_peer_length;
if (len == 0) {
redirect_cache = NULL;
return;
}
redirect_cache = (rule_t **)malloc(sizeof(rule_t *) * len); redirect_cache = (rule_t **)malloc(sizeof(rule_t *) * len);
bzero(redirect_cache, sizeof(rule_t *) * len); bzero(redirect_cache, sizeof(rule_t *) * len);
@ -573,7 +580,13 @@ reflesh_nft_peer_cache(void)
rule_t *p; rule_t *p;
int i; int i;
free(peer_cache); if (peer_cache != NULL) {
free(peer_cache);
}
if (rule_list_peer_length == 0) {
peer_cache = NULL;
return;
}
peer_cache = (rule_t **)malloc( peer_cache = (rule_t **)malloc(
sizeof(rule_t *) * rule_list_peer_length); sizeof(rule_t *) * rule_list_peer_length);
bzero(peer_cache, sizeof(rule_t *) * rule_list_peer_length); bzero(peer_cache, sizeof(rule_t *) * rule_list_peer_length);
@ -599,8 +612,9 @@ reflesh_nft_cache(uint32_t family)
rule_t *p1, *p2; rule_t *p1, *p2;
int ret; int ret;
if (rule_list_validate == RULE_CACHE_VALID) if (rule_list_validate == RULE_CACHE_VALID) {
return; return;
}
t = NULL; t = NULL;
p1 = LIST_FIRST(&head); p1 = LIST_FIRST(&head);