Crash_Override/OVMS3-idf
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mdns: fixed crash on free undefined ptr after skipped strdup

Browse source 
Shortcircuit evaluation may cause skip of _mdns_strdup_check of any further question field, which after clear_rx_packet freed undefined memory.
Fixes https://ezredmine.espressif.cn:8765/issues/28465
This commit is contained in:
David Cermak 2019-01-29 10:32:12 +01:00
parent 18118a6d5c
commit 43a722f0de
1 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
components/mdns/mdns.c
View file

@ -2487,15 +2487,19 @@ handle_error :
} }
/** /**
* @brief Duplicate string or return NULL * @brief Duplicate string or return error
*/ */
static char * _mdns_strdup_check(const char * in) static esp_err_t _mdns_strdup_check(char ** out, char * in)
{ {
if (in && in[0]) { if (in && in[0]) {
return strdup(in); *out = strdup(in);
} else { if (!*out) {
return NULL; return ESP_FAIL;
} }
return ESP_OK;
}
*out = NULL;
return ESP_OK;
} }
/** /**
@ -2624,11 +2628,10 @@ void mdns_parse_packet(mdns_rx_packet_t * packet)
question->unicast = unicast; question->unicast = unicast;
question->type = type; question->type = type;
question->host = _mdns_strdup_check(name->host); if (_mdns_strdup_check(&(question->host), name->host)
question->service = _mdns_strdup_check(name->service); || _mdns_strdup_check(&(question->service), name->service)
question->proto = _mdns_strdup_check(name->proto); || _mdns_strdup_check(&(question->proto), name->proto)
question->domain = _mdns_strdup_check(name->domain); || _mdns_strdup_check(&(question->domain), name->domain)) {
if (!question->host || !question->service || !question->proto || !question->domain) {
goto clear_rx_packet; goto clear_rx_packet;
} }
} }