From patchwork Thu Aug 17 17:09:29 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Sutter X-Patchwork-Id: 802755 X-Patchwork-Delegate: shemminger@vyatta.com Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xYCQx2x20z9t4g for ; Fri, 18 Aug 2017 03:10:49 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753416AbdHQRKs (ORCPT ); Thu, 17 Aug 2017 13:10:48 -0400 Received: from orbyte.nwl.cc ([151.80.46.58]:47405 "EHLO mail.nwl.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753386AbdHQRKq (ORCPT ); Thu, 17 Aug 2017 13:10:46 -0400 Received: from mail.nwl.cc (orbyte.nwl.cc [127.0.0.1]) by mail.nwl.cc (Postfix) with ESMTP id 2D6F4644C0; Thu, 17 Aug 2017 19:10:45 +0200 (CEST) Received: from xsao (localhost [IPv6:::1]) by mail.nwl.cc (Postfix) with ESMTP id 0FDE463864; Thu, 17 Aug 2017 19:10:45 +0200 (CEST) From: Phil Sutter To: Stephen Hemminger Cc: netdev@vger.kernel.org Subject: [iproute PATCH v2 3/5] tc/q_netem: Don't dereference possibly NULL pointer Date: Thu, 17 Aug 2017 19:09:29 +0200 Message-Id: <20170817170931.24545-4-phil@nwl.cc> X-Mailer: git-send-email 2.13.1 In-Reply-To: <20170817170931.24545-1-phil@nwl.cc> References: <20170817170931.24545-1-phil@nwl.cc> X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Assuming 'opt' might be NULL, move the call to RTA_PAYLOAD to after the check since it dereferences its parameter. Signed-off-by: Phil Sutter --- tc/q_netem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tc/q_netem.c b/tc/q_netem.c index 0975ae111de97..7e3330512041a 100644 --- a/tc/q_netem.c +++ b/tc/q_netem.c @@ -538,7 +538,7 @@ static int netem_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt) int *ecn = NULL; struct tc_netem_qopt qopt; const struct tc_netem_rate *rate = NULL; - int len = RTA_PAYLOAD(opt) - sizeof(qopt); + int len; __u64 rate64 = 0; SPRINT_BUF(b1); @@ -546,6 +546,8 @@ static int netem_print_opt(struct qdisc_util *qu, FILE *f, struct rtattr *opt) if (opt == NULL) return 0; + len = RTA_PAYLOAD(opt) - sizeof(qopt); + if (len < 0) { fprintf(stderr, "options size error\n"); return -1;