odhcpd: router: Fix out of scope memory access
authorHauke Mehrtens <hauke@hauke-m.de>
Mon, 2 Sep 2019 20:29:49 +0000 (22:29 +0200)
committerHans Dedecker <dedeckeh@gmail.com>
Tue, 3 Sep 2019 19:38:43 +0000 (21:38 +0200)
A pointer to search_buf is accessed by search_domain outside of the
if branch which defines search_buf. The compiler could already reuse
this memory.

Coverity: #1445747
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
src/router.c

index 07dd146085cf2b55a6db0bff15792ac3239f2c78..700e1ff8fcedc71ee8ee6f290be978e5873c24ef 100644 (file)
@@ -607,6 +607,7 @@ static int send_router_advert(struct interface *iface, const struct in6_addr *fr
                struct in6_addr dns_pref, *dns_addr = NULL;
                size_t dns_cnt = 0, search_len = iface->search_len;
                uint8_t *search_domain = iface->search;
+               uint8_t search_buf[256];
 
                /* DNS Recursive DNS */
                if (iface->dns_cnt > 0) {
@@ -630,8 +631,6 @@ static int send_router_advert(struct interface *iface, const struct in6_addr *fr
 
                /* DNS Search options */
                if (!search_domain && !res_init() && _res.dnsrch[0] && _res.dnsrch[0][0]) {
-                       uint8_t search_buf[256];
-
                        int len = dn_comp(_res.dnsrch[0], search_buf,
                                        sizeof(search_buf), NULL, NULL);
                        if (len > 0) {