networkd: fix memleak when the same NetDev is specified twice

hashmap_put() returns 0 if the (key, value) pair is already present in the
hashmap, and -EEXIST if the key exists, but the value is different.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13433

diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index b413abacff7f922e92bf9f06888c63b2de274635..2d42f0d742e944d4b6014f45e77704443f28b1ae 100644 (file)
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -728,13 +728,14 @@ int config_parse_stacked_netdev(const char *unit,
                 return log_oom();
 
         r = hashmap_put(*h, name, INT_TO_PTR(kind));
-        if (r < 0) {
+        if (r < 0)
                 log_syntax(unit, LOG_ERR, filename, line, r,
-                           "Cannot add NetDev '%s' to network, ignoring assignment: %m", rvalue);
-                return 0;
-        }
-
-        name = NULL;
+                           "Cannot add NetDev '%s' to network, ignoring assignment: %m", name);
+        else if (r == 0)
+                log_syntax(unit, LOG_DEBUG, filename, line, r,
+                           "NetDev '%s' specified twice, ignoring.", name);
+        else
+                name = NULL;
 
         return 0;
 }

diff --git a/test/fuzz/fuzz-network-parser/oss-fuzz-13433 b/test/fuzz/fuzz-network-parser/oss-fuzz-13433
new file mode 100644 (file)
index 0000000..1aef8b7
Binary files /dev/null and b/test/fuzz/fuzz-network-parser/oss-fuzz-13433 differ