net: Fix NULL pointer dereference when parsing ICMP6_ROUTER_ADVERTISE messages

During UEFI PXE boot in IPv6 network, if the DHCP server adopts stateful
automatic configuration, then the client receives a ICMP6_ROUTER_ADVERTISE
multicast message from the server. This may be received without the interface
having a configured network address, so orig_inf will be NULL, which can lead
to a NULL dereference when creating the default route. Actually, in this case,
the client obtains the default route through DHCPv6 instead of RA messages.
So if orig_inf == NULL and route_inf == NULL, we should not set the
default route.

Fixes: https://savannah.gnu.org/bugs/?62072
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/grub-core/net/icmp6.c b/grub-core/net/icmp6.c
index 986d57b013ff0f225d32a1aec2cca2c887b76907..9a8c4511285db0b71353a5f4c5c2b7688aa94da4 100644 (file)
--- a/grub-core/net/icmp6.c
+++ b/grub-core/net/icmp6.c
@@ -477,7 +477,7 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb,
 
            /* May not have gotten slaac info, find a global address on this
              card.  */
-           if (route_inf == NULL)
+           if (route_inf == NULL && orig_inf != NULL)
              {
                FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
                {