ipv6: fix NULL deref and OOB read in dnssl/AFTR-Name config parsing

add_dnssl() in nd.c and dhcpv6.c, and its copy add_aftr_gw() in
dhcpv6.c, call strlen(val) before the "if (!val)" guard, so a dnssl
option without a value crashes on config load before the check is
ever reached (also reported by cppcheck: "Either the condition '!val'
is redundant or there is possible null pointer dereference").

Moving strlen() after the guard is not enough: an empty value such as
a bare "dnssl=" or "aftr-gw=" passes the NULL check with n == 0 and
the following "val[n - 1]" reads one byte before the string.

Reject both NULL and empty values before taking the length.

Note these functions are only reached from the config parser (the
[ipv6-dns] section and the ipv6-dhcp "aftr-gw" option) at startup or
on config reload; nothing from received packets flows into them. So
this is a robustness fix for invalid/malformed configuration files
(local DoS at worst), not a remotely triggerable issue.

The NULL-check ordering in add_dnssl() was originally fixed by
[anp/hsw] in PR #13; this extends it to empty values and to the same
pattern in add_aftr_gw().

Co-authored-by: [anp/hsw] <sysop@880.ru>

0 files changed, 0 insertions, 0 deletions