libubus: fix NULL dereference on OOM in ubus_queue_msg

calloc_a() can return NULL under memory pressure. The returned pointer
was used immediately without a check, causing a NULL dereference crash.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/ubus/pull/20
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 6 insertions, 0 deletions

diff --git a/libubus.c b/libubus.c
index 5d22660..5526a9d 100644
--- a/libubus.c
+++ b/libubus.c
@@ -74,6 +74,10 @@ out:
 	return err;
 }
 
+/*
+ * Note: any SCM_RIGHTS fd attached to the original message is not propagated
+ * to the queued copy — the caller must close it (or hand it off) separately.
+ */
 static void
 ubus_queue_msg(struct ubus_context *ctx, struct ubus_msghdr_buf *buf)
 {
@@ -81,6 +85,8 @@ ubus_queue_msg(struct ubus_context *ctx, struct ubus_msghdr_buf *buf)
 	void *data;
 
 	pending = calloc_a(sizeof(*pending), &data, blob_raw_len(buf->data));
+	if (!pending)
+		return;
 
 	pending->hdr.data = data;
 	memcpy(&pending->hdr.hdr, &buf->hdr, sizeof(buf->hdr));