sven/can-utils
1
0
Fork 0
mirror of https://github.com/linux-can/can-utils.git synced 2026-11-04 15:31:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

cangw: fix NULL pointer dereference in modification parsing

Browse Source 
parse_mod() and parse_fdmod() did not check the return value of
strchr() when looking for the ':' delimiters. A modification definition
without ':' (e.g. '-m AND') led to a segmentation fault.

Add the missing NULL pointer checks.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
This commit is contained in:
Oliver Hartkopp
2026-10-14 11:15:54 +02:00
parent 411a68675f
commit 38cf8dd1a5
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cangw.c
+4 -4
View File
@@ -338,7 +338,7 @@ static int parse_mod(char *optarg, struct modattr *modmsg)
ptr = optarg; ptr = optarg;
nptr = strchr(ptr, ':'); nptr = strchr(ptr, ':');
if ((nptr - ptr > 3) || (nptr - ptr == 0)) if (!nptr || (nptr - ptr > 3) || (nptr - ptr == 0))
return 1; return 1;
if (!strncmp(ptr, "AND", 3)) if (!strncmp(ptr, "AND", 3))
@@ -355,7 +355,7 @@ static int parse_mod(char *optarg, struct modattr *modmsg)
ptr = nptr+1; ptr = nptr+1;
nptr = strchr(ptr, ':'); nptr = strchr(ptr, ':');
if ((nptr - ptr > 3) || (nptr - ptr == 0)) if (!nptr || (nptr - ptr > 3) || (nptr - ptr == 0))
return 3; return 3;
modmsg->modtype = 0; modmsg->modtype = 0;
@@ -406,7 +406,7 @@ static int parse_fdmod(char *optarg, struct fdmodattr *modmsg)
ptr = optarg; ptr = optarg;
nptr = strchr(ptr, ':'); nptr = strchr(ptr, ':');
if ((nptr - ptr > 3) || (nptr - ptr == 0)) if (!nptr || (nptr - ptr > 3) || (nptr - ptr == 0))
return 1; return 1;
if (!strncmp(ptr, "AND", 3)) if (!strncmp(ptr, "AND", 3))
@@ -423,7 +423,7 @@ static int parse_fdmod(char *optarg, struct fdmodattr *modmsg)
ptr = nptr+1; ptr = nptr+1;
nptr = strchr(ptr, ':'); nptr = strchr(ptr, ':');
if ((nptr - ptr > 4) || (nptr - ptr == 0)) if (!nptr || (nptr - ptr > 4) || (nptr - ptr == 0))
return 3; return 3;
modmsg->modtype = 0; modmsg->modtype = 0;