From ab639f236ff85d2f447cc6601c7ff42cefdaf853 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 19 Sep 2018 15:16:54 +0200 Subject: libxtables: Avoid calling memcpy() with NULL source Both affected functions check if 'oldopts' is NULL once but later seem to ignore that possibility. To catch up on that, increment the pointer only if it isn't NULL, also don't copy its content into the merged options buffer in that case. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- libxtables/xtables.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'libxtables/xtables.c') diff --git a/libxtables/xtables.c b/libxtables/xtables.c index f3966f15..1b8e4b07 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -119,8 +119,10 @@ struct option *xtables_merge_options(struct option *orig_opts, * Since @oldopts also has @orig_opts already (and does so at the * start), skip these entries. */ - oldopts += num_oold; - num_old -= num_oold; + if (oldopts != NULL) { + oldopts += num_oold; + num_old -= num_oold; + } merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1)); if (merge == NULL) @@ -139,8 +141,10 @@ struct option *xtables_merge_options(struct option *orig_opts, mp->val += *option_offset; /* Third, the old options */ - memcpy(mp, oldopts, sizeof(*mp) * num_old); - mp += num_old; + if (oldopts != NULL) { + memcpy(mp, oldopts, sizeof(*mp) * num_old); + mp += num_old; + } xtables_free_opts(0); /* Clear trailing entry */ -- cgit v1.2.3