瀏覽代碼

[slam] Avoid NULL pointer dereference in slam_pull_value()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 7 年之前
父節點
當前提交
64de7dc7fd
共有 1 個檔案被更改,包括 9 行新增5 行删除
  1. 9
    5
      src/net/udp/slam.c

+ 9
- 5
src/net/udp/slam.c 查看文件

@@ -400,12 +400,16 @@ static int slam_pull_value ( struct slam_request *slam,
400 400
 		return -EINVAL;
401 401
 	}
402 402
 
403
-	/* Read value */
403
+	/* Strip value */
404 404
 	iob_pull ( iobuf, len );
405
-	*value = ( *data & 0x1f );
406
-	while ( --len ) {
407
-		*value <<= 8;
408
-		*value |= *(++data);
405
+
406
+	/* Read value, if applicable */
407
+	if ( value ) {
408
+		*value = ( *data & 0x1f );
409
+		while ( --len ) {
410
+			*value <<= 8;
411
+			*value |= *(++data);
412
+		}
409 413
 	}
410 414
 
411 415
 	return 0;

Loading…
取消
儲存