| 1 | Subject: [PATCH] Fix dereferencing the wrong variable
|
| 2 |
|
| 3 | In line 1911 in ntp_io.c, the code calls `create_interface(port, ep2)` and saves
|
| 4 | the return value in the variable `ep`, which is then checked to not be `NULL` in
|
| 5 | the next line. In case `ep` is `NULL`, the code starting in line 1923 is
|
| 6 | executed. Keep in mind that `ep` is `NULL` in this branch. The error is logged
|
| 7 | in line 1928 and the address inside `ep` is converted using `stoa` by calling
|
| 8 | `stoa(&ep->sin)`. This would normally be fine since `socktoa` catches a `NULL`
|
| 9 | pointer in line 43 in socktoa.c but `&ep->sin` isn't `NULL` but 0x24 as the
|
| 10 | field isn't the first one in the `endpt` struct.
|
| 11 |
|
| 12 | This then causes a segmentation fault by dereferencing the pointer `0x24` in
|
| 13 | line 46 as the code tries to get the address family using `AF(sock)`.
|
| 14 |
|
| 15 | This only happens when ntpd cannot create an interface which seems to happen at
|
| 16 | boot time leading to 6 crashes on my machine on average.
|
| 17 |
|
| 18 | The issue is that someone accidentally typed `ep` instead of the correct `ep2`.
|
| 19 |
|
| 20 | This bug is being tracked as 3968 and 3928 upstream.
|
| 21 | ---
|
| 22 | ntpd/ntp_io.c | 4 ++--
|
| 23 | 1 file changed, 2 insertions(+), 2 deletions(-)
|
| 24 |
|
| 25 | diff --git a/ntpd/ntp_io.c b/ntpd/ntp_io.c
|
| 26 | index 9d79fe4..0e761ff 100644
|
| 27 | |
| 28 | |
| 29 | @@ -1921,11 +1921,11 @@ update_interfaces(
|
| 30 | }
|
| 31 | else {
|
| 32 | DPRINT_INTERFACE(3,
|
| 33 | - (ep, "updating ", " new - FAILED"));
|
| 34 | + (ep2, "updating ", " new - FAILED"));
|
| 35 |
|
| 36 | msyslog(LOG_ERR,
|
| 37 | "cannot bind address %s",
|
| 38 | - stoa(&ep->sin));
|
| 39 | + stoa(&ep2->sin));
|
| 40 | }
|
| 41 | free(ep2);
|
| 42 | }
|
| 43 | --
|
| 44 | 2.48.1
|
| 45 |
|