From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 10 Jul 2014 16:38:35 +0000 (+0200)
Subject: ubus: handle attribute access after NULL check in parse_subnets()
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0aaf63b89efb27bfa370aabc7550de10335abbe3;p=oweals%2Ffirewall3.git

ubus: handle attribute access after NULL check in parse_subnets()

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---

diff --git a/ubus.c b/ubus.c
index 5161922..0d83e0f 100644
--- a/ubus.c
+++ b/ubus.c
@@ -105,15 +105,18 @@ parse_subnet(enum fw3_family family, struct blob_attr *dict, int rem)
 
 static void
 parse_subnets(struct list_head *head, enum fw3_family family,
-              struct blob_attr *list, int rem)
+              struct blob_attr *list)
 {
 	struct blob_attr *cur;
 	struct fw3_address *addr;
+	int rem;
 
 	if (!list)
 		return;
 
-	__blob_for_each_attr(cur, list, rem)
+	rem = blobmsg_data_len(list);
+
+	__blob_for_each_attr(cur, blobmsg_data(list), rem)
 	{
 		addr = parse_subnet(family, blobmsg_data(cur), blobmsg_data_len(cur));
 
@@ -205,9 +208,9 @@ fw3_ubus_address(struct list_head *list, const char *net)
 		    strcmp(blobmsg_data(tb[ADDR_INTERFACE]), net) != 0)
 			continue;
 
-		parse_subnets(list, FW3_FAMILY_V4, blobmsg_data(tb[ADDR_IPV4]), blobmsg_data_len(tb[ADDR_IPV4]));
-		parse_subnets(list, FW3_FAMILY_V6, blobmsg_data(tb[ADDR_IPV6]), blobmsg_data_len(tb[ADDR_IPV6]));
-		parse_subnets(list, FW3_FAMILY_V6, blobmsg_data(tb[ADDR_IPV6_PREFIX]), blobmsg_data_len(tb[ADDR_IPV6_PREFIX]));
+		parse_subnets(list, FW3_FAMILY_V4, tb[ADDR_IPV4]);
+		parse_subnets(list, FW3_FAMILY_V6, tb[ADDR_IPV6]);
+		parse_subnets(list, FW3_FAMILY_V6, tb[ADDR_IPV6_PREFIX]);
 	}
 }