mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-14 10:29:33 +00:00
Toliak Purple
9eb0757da9
Reproduction Steps. Both commands cause a segmentation fault:
```
dnsmasq --interface-name=,
dnsmasq --dynamic-host=,::,
```
Stack Trace (ASAN, v2.90)
```
==1817==ERROR: AddressSanitizer: SEGV on unknown address
0x000000000000 (pc 0x7f0203d22845 bp 0x7ffc3316b920 sp 0x7ffc3316b0a0
T0)
==1817==The signal is caused by a READ memory access.
==1817==Hint: address points to the zero page.
#0 0x7f0203d22845 in __interceptor_strncmp
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:488
#1 0x5563361feeb3 in iface_allowed /opt/dnsmasq/src/network.c:361
#2 0x556336203aca in iface_allowed_v6 /opt/dnsmasq/src/network.c:622
#3 0x55633625cc4c in iface_enumerate /opt/dnsmasq/src/netlink.c:291
#4 0x55633620573c in enumerate_interfaces /opt/dnsmasq/src/network.c:836
#5 0x55633615c3fe in main /opt/dnsmasq/src/dnsmasq.c:367
```
The fault occurs due to a null-pointer dereference in iface_allowed()
at line 361:
```
if (strncmp(label, int_name->intr, IF_NAMESIZE) == 0) //// here
int_name->intr is NULL
```
That occurs due to a null-pointer assignment in the option.c at line 4856:
```
new->intr = opt_string_alloc(arg); //// if arg is empty
string, the opt_string_alloc will return NULL
```