diff options
| author | Hauke Mehrtens | 2026-04-12 22:10:19 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-05-23 00:47:20 +0000 |
| commit | f61695e6e12a622f6d6408c444f162ea6f13fdac (patch) | |
| tree | d03b4680546fa47fcb8a6cacb37a47e50ffad22d | |
| parent | 0c095592ccb79053dd02a57bf006dde2bd26ad28 (diff) | |
| download | ubus-f61695e6e12a622f6d6408c444f162ea6f13fdac.tar.gz | |
ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch
cl->user, cl->group, target->client->user, and target->client->group
can all be NULL if the earlier strdup() calls in ubusd_acl_init_client()
fail under memory pressure. Passing a NULL pointer to strcmp() is
undefined behaviour and causes a crash.
Guard each comparison with explicit NULL checks and treat NULL as
non-matching (deny access) to preserve the original security intent.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/ubus/pull/20
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | ubusd_proto.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ubusd_proto.c b/ubusd_proto.c index a25a2ce..8950d57 100644 --- a/ubusd_proto.c +++ b/ubusd_proto.c @@ -461,7 +461,11 @@ static int ubusd_handle_add_watch(struct ubus_client *cl, struct ubus_msg_buf *u return UBUS_STATUS_INVALID_ARGUMENT; if (!target->path.key) { - if (strcmp(target->client->user, cl->user) && strcmp(target->client->group, cl->group)) + bool same_user = target->client->user && cl->user && + !strcmp(target->client->user, cl->user); + bool same_group = target->client->group && cl->group && + !strcmp(target->client->group, cl->group); + if (!same_user && !same_group) return UBUS_STATUS_NOT_FOUND; } else if (ubusd_acl_check(cl, target->path.key, NULL, UBUS_ACL_SUBSCRIBE)) { return UBUS_STATUS_NOT_FOUND; |