radius: fix crash with l4-redirect with no ipv6 (T23)

1 files changed, 33 insertions, 3 deletions

diff --git a/accel-pppd/radius/radius.c b/accel-pppd/radius/radius.c
index 6a5e553..299fa4a 100644
--- a/accel-pppd/radius/radius.c
+++ b/accel-pppd/radius/radius.c
@@ -412,6 +412,11 @@ static int rad_pwdb_check(struct pwdb_t *pwdb, struct ap_session *ses, pwdb_call
 	struct radius_pd_t *rpd = find_pd(ses);
 	char username1[256];
 
+	if (!rpd) {
+		log_emerg("radius:%s:BUG: rpd not found\n", __func__);
+		abort();
+	}
+
 	if (conf_strip_realm || conf_default_realm) {
 		int len = strchrnul(username, '@') - username;
 		if (conf_strip_realm && username[len]) {
@@ -482,8 +487,12 @@ static struct ipv4db_item_t *get_ipv4(struct ap_session *ses)
 {
 	struct radius_pd_t *rpd = find_pd(ses);
 
+	if (!rpd)
+		return NULL;
+
 	if (rpd->ipv4_addr.peer_addr)
 		return &rpd->ipv4_addr;
+
 	return NULL;
 }
 
@@ -491,6 +500,9 @@ static struct ipv6db_item_t *get_ipv6(struct ap_session *ses)
 {
 	struct radius_pd_t *rpd = find_pd(ses);
 
+	if (!rpd)
+		return NULL;
+
 	rpd->ipv6_addr.intf_id = 0;
 
 	if (!list_empty(&rpd->ipv6_addr.addr_list))
@@ -503,6 +515,9 @@ static struct ipv6db_prefix_t *get_ipv6_prefix(struct ap_session *ses)
 {
 	struct radius_pd_t *rpd = find_pd(ses);
 
+	if (!rpd)
+		return NULL;
+
 	if (!list_empty(&rpd->ipv6_dp.prefix_list)) {
 		rpd->ipv6_dp_assigned = 1;
 		return &rpd->ipv6_dp;
@@ -574,7 +589,7 @@ static void ses_acct_start(struct ap_session *ses)
 	if (!conf_accounting)
 		return;
 
-	if (!rpd->authenticated)
+	if (!rpd || !rpd->authenticated)
 		return;
 
 	if (rad_acct_start(rpd)) {
@@ -591,6 +606,11 @@ static void ses_started(struct ap_session *ses)
 	struct framed_ip6_route *fr6;
 	struct framed_route *fr;
 
+	if (!rpd) {
+		log_emerg("radius:%s:BUG: rpd not found\n", __func__);
+		abort();
+	}
+
 	if (rpd->session_timeout.expire_tv.tv_sec) {
 		rpd->session_timeout.expire = session_timeout;
 		triton_timer_add(ses->ctrl->ctx, &rpd->session_timeout, 0);
@@ -629,6 +649,11 @@ static void ses_finishing(struct ap_session *ses)
 	struct framed_ip6_route *fr6;
 	struct framed_route *fr;
 
+	if (!rpd) {
+		log_emerg("radius:%s:BUG: rpd not found\n", __func__);
+		abort();
+	}
+
 	if (rpd->auth_ctx) {
 		rad_server_req_cancel(rpd->auth_ctx->req, 1);
 		rad_req_free(rpd->auth_ctx->req);
@@ -662,6 +687,11 @@ static void ses_finished(struct ap_session *ses)
 	struct framed_route *fr = rpd->fr;
 	struct framed_ip6_route *fr6;
 
+	if (!rpd) {
+		log_emerg("radius:%s:BUG: rpd not found\n", __func__);
+		abort();
+	}
+
 	pthread_rwlock_wrlock(&sessions_lock);
 	pthread_mutex_lock(&rpd->lock);
 	list_del(&rpd->entry);
@@ -757,8 +787,8 @@ struct radius_pd_t *find_pd(struct ap_session *ses)
 			return rpd;
 		}
 	}
-	log_emerg("radius:BUG: rpd not found\n");
-	abort();
+
+	return NULL;
 }
 
 void hold_pd(struct radius_pd_t *rpd)