xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

kernel: fix cb->f[0] nil dereferences due to short control request

Browse source
This commit is contained in:
cinap_lenrek 2016-05-05 18:54:58 +02:00
parent 7d45ee4f6a
commit 66719fb3ea
4 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
sys/src/9/ip/iproute.c
View file

@ -797,7 +797,8 @@ routewrite(Fs *f, Chan *c, char *p, int n)
free(cb);
nexterror();
}
if(cb->nf < 1)
error("short control request");
if(strcmp(cb->f[0], "flush") == 0){
tag = cb->f[1];
for(h = 0; h < nelem(f->v4root); h++)
@ -846,7 +847,8 @@ routewrite(Fs *f, Chan *c, char *p, int n)
na = newipaux(a->owner, cb->f[1]);
c->aux = na;
free(a);
}
} else
error(Ebadctl);
poperror();
free(cb);

2
sys/src/9/port/devsegment.c
View file

@ -313,7 +313,7 @@ segmentwrite(Chan *c, void *a, long n, vlong voff)
free(cb);
nexterror();
}
if(strcmp(cb->f[0], "va") == 0){
if(cb->nf > 0 && strcmp(cb->f[0], "va") == 0){
if(g->s != nil)
error("already has a virtual address");
if(cb->nf < 3)

2
sys/src/9/port/devusb.c
View file

@ -1124,8 +1124,6 @@ epctl(Ep *ep, Chan *c, void *a, long n)
nexterror();
}
ct = lookupcmd(cb, epctls, nelem(epctls));
if(ct == nil)
error(Ebadctl);
i = ct->index;
if(i == CMnew || i == CMspeed || i == CMhub || i == CMpreset)
if(ep != ep->ep0)

2
sys/src/9/port/led.c
View file

@ -53,7 +53,7 @@ ledw(Ledport *p, Chan*, void *a, long n, vlong)
Cmdbuf *cb;
cb = parsecmd(a, n);
i = name2led(cb->f[0]);
i = cb->nf < 1 ? -1 : name2led(cb->f[0]);
free(cb);
if(i == -1)
error(Ebadarg);