diff options
| author | Hauke Mehrtens | 2026-04-16 20:22:26 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-05-23 00:47:44 +0000 |
| commit | 7e4356da8abea2351643962376bc91bbc9e8ad5c (patch) | |
| tree | f760de04bf776cca640f76b81b94209091e2e0bc | |
| parent | 4ca0b141e9a72a8a87feff3aa6f3ae57a9827177 (diff) | |
| download | ubus-7e4356da8abea2351643962376bc91bbc9e8ad5c.tar.gz | |
ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message
ubus_msg_new() can return NULL on allocation failure, but the
subsequent assignment to ub->hdr.type was unconditional, causing a
NULL pointer dereference. Bail out early when allocation fails.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/ubus/pull/20
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | ubusd_monitor.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ubusd_monitor.c b/ubusd_monitor.c index bba741e..cad6b37 100644 --- a/ubusd_monitor.c +++ b/ubusd_monitor.c @@ -91,6 +91,8 @@ ubusd_monitor_message(struct ubus_client *cl, struct ubus_msg_buf *ub, bool send blob_put(&mb, UBUS_MONITOR_DATA, blob_data(ub->data), blob_len(ub->data)); ub = ubus_msg_new(mb.head, blob_raw_len(mb.head), true); + if (!ub) + return; ub->hdr.type = UBUS_MSG_MONITOR; list_for_each_entry(m, &monitors, list) { |