diff options
| author | Vladislav Grishenko <themiron@mail.ru> | 2018-03-04 02:29:46 +0500 |
|---|---|---|
| committer | Vladislav Grishenko <themiron@mail.ru> | 2018-03-04 02:41:47 +0500 |
| commit | 939e952452dd856a574a1d78c15181a93a593996 (patch) | |
| tree | 3e6b12fab35b12cda2be553faec05755a598d4da /accel-pppd/ctrl | |
| parent | 5ccf2f0409c18e216c4da5c7cce5e9fcf14ebf54 (diff) | |
| download | accel-ppp-xebd-939e952452dd856a574a1d78c15181a93a593996.tar.gz accel-ppp-xebd-939e952452dd856a574a1d78c15181a93a593996.zip | |
fix possible null pointer dereferences
Diffstat (limited to 'accel-pppd/ctrl')
| -rw-r--r-- | accel-pppd/ctrl/ipoe/dhcpv4.c | 4 | ||||
| -rw-r--r-- | accel-pppd/ctrl/l2tp/l2tp.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/accel-pppd/ctrl/ipoe/dhcpv4.c b/accel-pppd/ctrl/ipoe/dhcpv4.c index dde5060..8a395ea 100644 --- a/accel-pppd/ctrl/ipoe/dhcpv4.c +++ b/accel-pppd/ctrl/ipoe/dhcpv4.c @@ -1145,7 +1145,7 @@ void dhcpv4_reserve_ip(struct dhcpv4_serv *serv, uint32_t ip) struct dhcpv4_packet *dhcpv4_clone_radius(struct rad_packet_t *rad) { struct dhcpv4_packet *pkt = dhcpv4_packet_alloc(); - uint8_t *ptr = pkt->data, *endptr = ptr + BUF_SIZE; + uint8_t *ptr, *endptr; struct dhcpv4_option *opt; struct rad_attr_t *attr; @@ -1153,6 +1153,8 @@ struct dhcpv4_packet *dhcpv4_clone_radius(struct rad_packet_t *rad) return NULL; pkt->refs = 1; + ptr = pkt->data; + endptr = ptr + BUF_SIZE; list_for_each_entry(attr, &rad->attrs, entry) { if (attr->vendor && attr->vendor->id == VENDOR_DHCP && attr->attr->id < 256) { diff --git a/accel-pppd/ctrl/l2tp/l2tp.c b/accel-pppd/ctrl/l2tp/l2tp.c index 55881b8..cbb9de6 100644 --- a/accel-pppd/ctrl/l2tp/l2tp.c +++ b/accel-pppd/ctrl/l2tp/l2tp.c @@ -3119,7 +3119,7 @@ static int rescode_get_data(const struct l2tp_attr_t *result_attr, return 2; *err_msg = _malloc(msglen + 1); - if (err_msg) { + if (*err_msg) { memcpy(*err_msg, resavp->error_msg, msglen); (*err_msg)[msglen] = '\0'; } |