diff options
| author | Hauke Mehrtens | 2026-04-12 22:08:04 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-05-23 00:46:58 +0000 |
| commit | 497321a5ea90093fbf05d786a120afd3f8bdb6fb (patch) | |
| tree | b8e5a7b4965861c2e612761aa53095daeddfd4b2 | |
| parent | 07d7f34ac278c28817b41c8814df2cc1d303495f (diff) | |
| download | ubus-497321a5ea90093fbf05d786a120afd3f8bdb6fb.tar.gz | |
ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init
ubusd_create_object_internal() can return NULL if ubus_alloc_id()
fails (e.g. when reading from /dev/urandom fails). The recv_msg
assignment was performed unconditionally, causing a NULL dereference.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/ubus/pull/20
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | ubusd_acl.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ubusd_acl.c b/ubusd_acl.c index e81643b..ec1aacb 100644 --- a/ubusd_acl.c +++ b/ubusd_acl.c @@ -686,5 +686,6 @@ void ubusd_acl_init(void) { ubus_init_string_tree(&ubusd_acls, true); acl_obj = ubusd_create_object_internal(NULL, UBUS_SYSTEM_OBJECT_ACL); - acl_obj->recv_msg = ubusd_acl_recv; + if (acl_obj) + acl_obj->recv_msg = ubusd_acl_recv; } |