shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-08-24 09:49:49 +03:00
Code Activity

libsystemd-network: refuse too large raw_size

Browse Source 
Closes #23258.
This commit is contained in:
Yu Watanabe
2022-05-04 15:45:13 +09:00
parent fa2ba7aea8
commit 4e88a46bfe
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/libsystemd-network/lldp-neighbor.c
View File

@ -116,6 +116,9 @@ sd_lldp_neighbor *lldp_neighbor_unlink(sd_lldp_neighbor *n) {
sd_lldp_neighbor *lldp_neighbor_new(size_t raw_size) { sd_lldp_neighbor *lldp_neighbor_new(size_t raw_size) {
sd_lldp_neighbor *n; sd_lldp_neighbor *n;
if (raw_size > SIZE_MAX - ALIGN(sizeof(sd_lldp_neighbor)))
return NULL;
n = malloc0(ALIGN(sizeof(sd_lldp_neighbor)) + raw_size); n = malloc0(ALIGN(sizeof(sd_lldp_neighbor)) + raw_size);
if (!n) if (!n)
return NULL; return NULL;

3
src/libsystemd-network/ndisc-router.c
View File

@ -21,6 +21,9 @@ DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(sd_ndisc_router, sd_ndisc_router, mfree);
sd_ndisc_router *ndisc_router_new(size_t raw_size) { sd_ndisc_router *ndisc_router_new(size_t raw_size) {
sd_ndisc_router *rt; sd_ndisc_router *rt;
if (raw_size > SIZE_MAX - ALIGN(sizeof(sd_ndisc_router)))
return NULL;
rt = malloc0(ALIGN(sizeof(sd_ndisc_router)) + raw_size); rt = malloc0(ALIGN(sizeof(sd_ndisc_router)) + raw_size);
if (!rt) if (!rt)
return NULL; return NULL;