Skip to content

Commit 7c28dad

Browse files
committed
mctp-netlink: Don't qsort() when target list is NULL
Mitigate the following ubsan splat: Feb 27 09:32:23 test mctpd[1034]: ../git/src/mctp-netlink.c:960:3: runtime error: null pointer passed as argument 1, which is declared to never be null Feb 27 09:32:23 test mctpd[1034]: #0 0x4552c4 (/usr/sbin/mctpd+0x4a2c4) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8) Feb 27 09:32:23 test mctpd[1034]: #1 0x42c3b0 (/usr/sbin/mctpd+0x213b0) (BuildId: 0a2c71201a0ddde8f9bbe7d2fd65628c4e08f5d8) Feb 27 09:32:23 test mctpd[1034]: #2 0xa623b4ac (/usr/lib/libc.so.6+0x1f4ac) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b) Feb 27 09:32:23 test mctpd[1034]: #3 0xa623b598 in __libc_start_main (/usr/lib/libc.so.6+0x1f598) (BuildId: f7dfc12cfaed3ca290b3c7f41ef9145c0de0fe6b) glibc (e.g. 2.41) declares qsort as: extern void qsort (void *__base, size_t __nmemb, size_t __size, __compar_fn_t __compar) __nonnull ((1, 4)); Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
1 parent 236330c commit 7c28dad

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

src/mctp-netlink.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -952,13 +952,17 @@ static void sort_linkmap(mctp_nl *nl)
952952
{
953953
size_t i;
954954

955-
qsort(nl->linkmap, nl->linkmap_count, sizeof(*nl->linkmap),
956-
cmp_ifindex);
955+
if (nl->linkmap) {
956+
qsort(nl->linkmap, nl->linkmap_count, sizeof(*nl->linkmap),
957+
cmp_ifindex);
958+
}
957959

958960
for (i = 0; i < nl->linkmap_count; i++) {
959961
struct linkmap_entry *entry = &nl->linkmap[i];
960-
qsort(entry->local_eids, entry->num_local, sizeof(mctp_eid_t),
961-
cmp_eid);
962+
if (entry->local_eids) {
963+
qsort(entry->local_eids, entry->num_local,
964+
sizeof(mctp_eid_t), cmp_eid);
965+
}
962966
}
963967
}
964968

0 commit comments

Comments
 (0)