[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] net/route: Fix NULL pointer dereference when deleting last r

From: Vladimir 'φ-coder/phcoder' Serbinenko
Subject: Re: [PATCH] net/route: Fix NULL pointer dereference when deleting last route
Date: Fri, 23 Dec 2011 11:54:49 +0100
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20111114 Icedove/3.1.16

On 06.12.2011 10:42, Jeremy Kerr wrote:
Currently, grub_cmd_delroute will crash when deleting the last route.
In the deletion code, we remove the matching route from the route list:

   *prev = route->next

- route->next being NULL to mark the end of the list. We then process
the for loop's iterator, which contains:

   prev =&((*prev)->next)


   prev = NULL->next;

Instead, break out of the for-loop when we've deleted the route.

        * grub-core/net/net.c (grub_cmd_delroute): fix NULL deref when deleting
        last route
Bug is real but fix is wrong. Committed the right fix.
  grub-core/net/net.c |    1 +
  1 file changed, 1 insertion(+)

diff --git a/grub-core/net/net.c b/grub-core/net/net.c
index 09acea9..cafec41 100644
--- a/grub-core/net/net.c
+++ b/grub-core/net/net.c
@@ -430,6 +430,7 @@ grub_cmd_delroute (struct grub_command *cmd __attribute__ 
        *prev = route->next;
        grub_free (route->name);
        grub_free (route);
+       break;

    return GRUB_ERR_NONE;

Grub-devel mailing list

Vladimir 'φ-coder/phcoder' Serbinenko

reply via email to

[Prev in Thread] Current Thread [Next in Thread]