odhcpd: router: Fix out of scope memory access
authorHauke Mehrtens <hauke@hauke-m.de>
Mon, 2 Sep 2019 20:29:49 +0000 (22:29 +0200)
committerHans Dedecker <dedeckeh@gmail.com>
Tue, 3 Sep 2019 19:47:44 +0000 (21:47 +0200)
A pointer to search_buf is accessed by search_domain outside of the
if branch which defines search_buf. The compiler could already reuse
this memory.

Coverity: #1445747
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
src/router.c

index 812946d6014afaef4e0e4aa6b685a803afd63cfd..84fe849ab5d5c9bcaa7ca4d1dc5fe20ba676fa91 100644 (file)
@@ -604,6 +604,7 @@ static int send_router_advert(struct interface *iface, const struct in6_addr *fr
                struct in6_addr dns_pref, *dns_addr = NULL;
                size_t dns_cnt = 0, search_len = iface->search_len;
                uint8_t *search_domain = iface->search;
+               uint8_t search_buf[256];
 
                /* DNS Recursive DNS */
                if (iface->dns_cnt > 0) {
@@ -627,8 +628,6 @@ static int send_router_advert(struct interface *iface, const struct in6_addr *fr
 
                /* DNS Search options */
                if (!search_domain && !res_init() && _res.dnsrch[0] && _res.dnsrch[0][0]) {
-                       uint8_t search_buf[256];
-
                        int len = dn_comp(_res.dnsrch[0], search_buf,
                                        sizeof(search_buf), NULL, NULL);
                        if (len > 0) {