From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Tue, 26 Jan 2021 21:52:32 +0000 (+0000)
Subject: Deal with error paths in callers of dict_attr_alloc_null
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=151fb347f60c8ab2700b80f28d254ca72438aecb;p=thirdparty%2Ffreeradius-server.git

Deal with error paths in callers of dict_attr_alloc_null
---

diff --git a/src/lib/util/dict_util.c b/src/lib/util/dict_util.c
index 826fdef10c..89ab00116a 100644
--- a/src/lib/util/dict_util.c
+++ b/src/lib/util/dict_util.c
@@ -616,9 +616,23 @@ fr_dict_attr_t *dict_attr_alloc_null(TALLOC_CTX *ctx)
 {
 	fr_dict_attr_t *da;
 
+	/*
+	 *	Do not use talloc zero, the caller
+	 *	always initialises memory allocated
+	 *	here.
+	 */
 	da = talloc(ctx, fr_dict_attr_t);
 	if (unlikely(!da)) return NULL;
 
+	/*
+	 *	On error paths in the caller, the
+	 *	caller may free the attribute
+	 *	allocated here without initialising
+	 *	the ext array, which is then
+	 *	accessed in the destructor.
+	 */
+	memset(da->ext, 0, sizeof(da->ext));
+
 	talloc_set_destructor(da, _dict_attr_free);
 
 	return da;