[v4_1_esv] Corrected several potential null references identified by static analysis

    Merges branch rt40754 - note merge was manual, not all patches applied.

diff --git a/RELNOTES b/RELNOTES
index 0eb2bbf047f9f8694e25aeaa820ff4fd3912db39..2d73313f4589c69d5d6f6c1a57c68fba6b545351 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -60,6 +60,11 @@ by Eric Young (eay@cryptsoft.com).
 
                        Changes since 4.1-ESV-R12
 
+- Fixed several potential null references.  Thanks to Bill Parker
+  (wp02855 at gmail dot com) who identified these issues and supplied
+  patches to address them.
+  [ISC-Bugs #40754]
+
 - The linux packet fitler code now correctly treats only least significant
   12 bits an inbound packet's TCI value as the VLAN id (per IEEE 802.1Q).
   Prior to this it was using the entire 16 bit value as the VLAN id and

diff --git a/client/dhc6.c b/client/dhc6.c
index 7a213ad4b3a84788f4b891739116de5a5abc2e0f..d7def67683d8402b3e6e0ee3fcb59602c0eabc24 100644 (file)
--- a/client/dhc6.c
+++ b/client/dhc6.c
@@ -529,6 +529,10 @@ dhc6_dup_ia(struct dhc6_ia *ia, const char *file, int line)
        struct dhc6_addr **insert_addr, *addr;
 
        copy = dmalloc(sizeof(*ia), file, line);
+       if (copy == NULL) {
+               log_error("Out of memory for v6 duplicate IA structure.");
+               return NULL;
+       }
 
        memcpy(copy->iaid, ia->iaid, sizeof(copy->iaid));
 

diff --git a/common/ctrace.c b/common/ctrace.c
index 578ea5e7b97598450ea7eb20f526b5539836e979..8db562cd90825dc6da55b28002ce8af479d5ea61 100644 (file)
--- a/common/ctrace.c
+++ b/common/ctrace.c
@@ -3,7 +3,7 @@
    Subroutines that support dhcp tracing... */
 
 /*
- * Copyright (c) 2004,2007,2009,2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2015 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2001-2003 by Internet Software Consortium
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -84,6 +84,13 @@ void trace_interface_input (trace_type_t *ttype, unsigned len, char *buf)
         */
        ip->address_count = ip->address_max = 1;
        ip->addresses = dmalloc(sizeof(*ip->addresses), MDL);
+       if (!ip->addresses) {
+               dfree(ip->ifp, MDL); 
+               ip->ifp = NULL;
+               interface_dereference (&ip, MDL);
+               status = ISC_R_NOMEMORY;
+               goto foo;
+       }
        memcpy(ip->addresses, &tipkt->primary_address, sizeof(*ip->addresses));
        memcpy (ip -> name, tipkt -> name, sizeof ip -> name);
        ip -> index = ntohl (tipkt -> index);

diff --git a/server/dhcpd.c b/server/dhcpd.c
index 1a2cb028d5a04943937e15a5703e462870d411ec..8b161c21196a3517ed31a54ebfbff9329906487a 100644 (file)
--- a/server/dhcpd.c
+++ b/server/dhcpd.c
@@ -1321,6 +1321,8 @@ int dhcpd_interface_setup_hook (struct interface_info *ip, struct iaddr *ia)
                        log_fatal ("No memory for shared subnet: %s",
                                   isc_result_totext (status));
                ip -> shared_network -> name = dmalloc (strlen (fnn) + 1, MDL);
+               if (!ip -> shared_network -> name)
+                       log_fatal("no memory for shared network");
                strcpy (ip -> shared_network -> name, fnn);
                return 1;
        }

diff --git a/server/omapi.c b/server/omapi.c
index 574f4f52274c0128a60676cf4d4e074ba6fc6eda..e00ae85893ce90dadf496341987cb7fd201856c0 100644 (file)
--- a/server/omapi.c
+++ b/server/omapi.c
@@ -3,7 +3,7 @@
    OMAPI object interfaces for the DHCP server. */
 
 /*
- * Copyright (c) 2012-2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2012-2015 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1999-2003 by Internet Software Consortium
  *
@@ -2095,6 +2095,8 @@ static isc_result_t class_lookup (omapi_object_t **lp,
        status = omapi_get_value_str (ref, id, "name", &nv);
        if (status == ISC_R_SUCCESS) {
                char *name = dmalloc(nv -> value -> u.buffer.len + 1, MDL);
+               if (name == NULL)
+                       return (ISC_R_NOMEMORY);
                memcpy (name,
                        nv -> value -> u.buffer.value,
                        nv -> value -> u.buffer.len);

diff --git a/server/salloc.c b/server/salloc.c
index 97fa25762c3bc311f4f7807eb451e1e2fa953c7d..db9427af5e6e1fe8a7e791105044e68c83be4d4e 100644 (file)
--- a/server/salloc.c
+++ b/server/salloc.c
@@ -3,7 +3,7 @@
    Memory allocation for the DHCP server... */
 
 /*
- * Copyright (c) 2009,2012,2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2009-2015 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 2004-2007 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1996-2003 by Internet Software Consortium
  *
@@ -79,6 +79,7 @@ void relinquish_lease_hunks ()
                dfree(c, MDL);
        }
 }
+
 #endif
 
 struct lease *new_leases (n, file, line)
@@ -89,11 +90,13 @@ struct lease *new_leases (n, file, line)
        struct lease *rval;
 #if defined (DEBUG_MEMORY_LEAKAGE_ON_EXIT)
        rval = dmalloc ((n + 1) * sizeof (struct lease), file, line);
-       memset (rval, 0, sizeof (struct lease));
-       rval -> starts = n;
-       rval -> next = lease_hunks;
-       lease_hunks = rval;
-       rval++;
+       if (rval != NULL) {
+               memset (rval, 0, sizeof (struct lease));
+               rval -> starts = n;
+               rval -> next = lease_hunks;
+               lease_hunks = rval;
+               rval++;
+       }
 #else
        rval = dmalloc (n * sizeof (struct lease), file, line);
 #endif