diff mbox series

[OpenWrt-Devel,opkg-lede] libopkg: Fix segfault on trailing comma in deps

Message ID 20190417175229.1333-1-patrick.mcdermott@libiquity.com
State Under Review
Delegated to: Petr Štetiar
Headers show
Series [OpenWrt-Devel,opkg-lede] libopkg: Fix segfault on trailing comma in deps | expand

Commit Message

Patrick McDermott April 17, 2019, 5:52 p.m. UTC
A "Depends" or other package relationship field with a trailing comma
(followed by zero or more whitespace characters) in any package feed
list will cause opkg after commit 98ce8c2 ("pkg: convert most other
struct members into dynamic blob buffer fields") to segfault.

In the case of a trailing comma, parseDepends() has always been called
with a string containing only the whitespace (if any) following the
comma, and previously a copy loop extracted the dependency package name
as an empty string.  Now, strtok() returns NULL as the package name,
which is passed through ensure_abstract_pkg_by_name(),
abstract_pkg_fetch_by_name(), hash_table_get(), hash_index(), and
finally djb2_hash() which dereferences the NULL pointer.

Signed-off-by: Patrick McDermott <patrick.mcdermott@libiquity.com>
 libopkg/pkg_depends.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series


diff --git a/libopkg/pkg_depends.c b/libopkg/pkg_depends.c
index 3abdcd3..6d075f2 100644
--- a/libopkg/pkg_depends.c
+++ b/libopkg/pkg_depends.c
@@ -1025,6 +1025,8 @@  static int parseDepends(compound_depend_t * compound_depend, char *depend_str, e
 	for (i = 0, depend = strtok_r(depend_str, "|", &tok); depend; i++, depend = strtok_r(NULL, "|", &tok)) {
 		name = strtok(depend, " ");
+		if (!name)
+			break;
 		rest = strtok(NULL, "\n");
 		tmp = realloc(possibilities, sizeof(tmp) * (i + 1));