Page MenuHomeFreeBSD

Static analysis: Fix potential NULL dereference in ICMP6 code
ClosedPublic

Authored by jtl on May 26 2017, 4:54 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Nov 21, 10:52 AM
Unknown Object (File)
Wed, Nov 20, 8:38 PM
Unknown Object (File)
Fri, Nov 15, 5:24 PM
Unknown Object (File)
Sun, Nov 3, 8:18 PM
Unknown Object (File)
Oct 22 2024, 6:03 PM
Unknown Object (File)
Oct 8 2024, 12:36 PM
Unknown Object (File)
Oct 8 2024, 10:40 AM
Unknown Object (File)
Oct 5 2024, 7:53 AM
Subscribers

Details

Summary

I ran clang's static analyzer over the kernel sources. It identified (apparently, correctly) two places in the ICMP6 code where we could dereference a NULL pointer in the icmp6_input() function.

When processing an ICMP6_ECHO_REQUEST, if IP6_EXTHDR_GET fails, it will set nicmp6 and n to NULL. Therefore, we should condition our modification to nicmp6 on n being not NULL.

And, when processing an ICMP6_WRUREQUEST in the (mode != FQDN) case, if m_dup_pkthdr() fails, the code will set n to NULL. However, the very next line dereferences n. Therefore, when m_dup_pkthdr() fails, we should discontinue further processing and follow the same path as when m_gethdr() fails.

Sponsored by: Netflix
MFC after: 2 weeks

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable