diff options
| author | Felix Fietkau | 2025-10-17 10:25:55 +0000 |
|---|---|---|
| committer | Felix Fietkau | 2025-10-17 10:27:58 +0000 |
| commit | aa4a7ee1d3417bc11207ad0a78d579ece7fe0c13 (patch) | |
| tree | 18004d6950131e6a8de1831a26821e650f46fa22 | |
| parent | 7d7b45fea05b97c880d02adf4bf6144ea4627b66 (diff) | |
ubusd: fix more instances of missing length checks for patterns
More instances of the same bug fixed by commit d31effb4277bd5.
Reported-by: Karsten Sperling <ksperling@apple.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | ubusd_acl.c | 17 | ||||
| -rw-r--r-- | ubusd_proto.c | 3 |
2 files changed, 20 insertions, 0 deletions
diff --git a/ubusd_acl.c b/ubusd_acl.c index 0979b5e..a5429cd 100644 --- a/ubusd_acl.c +++ b/ubusd_acl.c @@ -307,6 +307,9 @@ ubusd_acl_alloc_obj(struct ubusd_acl_file *file, const char *obj) char *k; bool partial = false; + if (!len) + return NULL; + if (obj[len - 1] == '*') { partial = true; len--; @@ -339,6 +342,8 @@ ubusd_acl_add_access(struct ubusd_acl_file *file, struct blob_attr *obj) return; o = ubusd_acl_alloc_obj(file, blobmsg_name(obj)); + if (!o) + return; o->methods = tb[ACL_ACCESS_METHODS]; o->tags = tb[ACL_ACCESS_TAGS]; @@ -353,6 +358,9 @@ ubusd_acl_add_subscribe(struct ubusd_acl_file *file, const char *obj) { struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj); + if (!o) + return; + o->subscribe = true; } @@ -361,6 +369,9 @@ ubusd_acl_add_publish(struct ubusd_acl_file *file, const char *obj) { struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj); + if (!o) + return; + o->publish = true; } @@ -368,6 +379,9 @@ static void ubusd_acl_add_listen(struct ubusd_acl_file *file, const char *obj) { struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj); + if (!o) + return; + o->listen = true; } @@ -375,6 +389,9 @@ static void ubusd_acl_add_send(struct ubusd_acl_file *file, const char *obj) { struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj); + if (!o) + return; + o->send = true; } diff --git a/ubusd_proto.c b/ubusd_proto.c index 48de9b9..31263dc 100644 --- a/ubusd_proto.c +++ b/ubusd_proto.c @@ -241,6 +241,9 @@ static int __ubusd_handle_lookup(struct ubus_client *cl, objpath = blob_data(attr[UBUS_ATTR_OBJPATH]); len = strlen(objpath); + if (!len) + return UBUS_STATUS_INVALID_ARGUMENT; + if (objpath[len - 1] != '*') { obj = avl_find_element(&path, objpath, obj, path); if (!obj) |