浏览代码

[ipv6] Avoid potentially copying from a NULL pointer in ipv6_tx()

If ipv6_tx() is called with a non-NULL network device, a NULL or
unspecified source address, and a destination address which does not
match any routing table entry, then it will attempt to copy the source
address from a NULL pointer.

I don't think that there is currently any code path which could
trigger this behaviour, but we should probably ensure that it can
never happen.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 10 年前
父节点
当前提交
7627f6c071
共有 1 个文件被更改,包括 2 次插入1 次删除
  1. 2
    1
      src/net/ipv6.c

+ 2
- 1
src/net/ipv6.c 查看文件

@@ -515,7 +515,8 @@ static int ipv6_tx ( struct io_buffer *iobuf,
515 515
 	}
516 516
 	if ( sin6_src && ! IN6_IS_ADDR_UNSPECIFIED ( &sin6_src->sin6_addr ) )
517 517
 		src = &sin6_src->sin6_addr;
518
-	memcpy ( &iphdr->src, src, sizeof ( iphdr->src ) );
518
+	if ( src )
519
+		memcpy ( &iphdr->src, src, sizeof ( iphdr->src ) );
519 520
 
520 521
 	/* Fix up checksums */
521 522
 	if ( trans_csum ) {

正在加载...
取消
保存