From: Dave Hart <hart@ntp.org>
Date: Tue, 20 Jun 2023 18:41:45 +0000 (+0000)
Subject: [Bug 3837] NULL pointer deref crash when ntpd deletes last interface.
X-Git-Tag: NTP_4_2_8P18_RC1~46^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=173bca42dd4d8185d608f49c905bd37cbd6cfbbd;p=thirdparty%2Fntp.git

[Bug 3837] NULL pointer deref crash when ntpd deletes last interface.
           Correct UNLINK_EXPR_SLIST() when the list is empty.

bk: 6491f2e9h9dRK-n2x5FjCsRYlDjiZQ
---

diff --git a/ChangeLog b/ChangeLog
index 93cdab8b9..a672f0522 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+---
+* [Bug 3837] NULL pointer deref crash when ntpd deletes last interface.
+             Reported by renmingshuai.  Correct UNLINK_EXPR_SLIST() when the
+             list is empty. <hart@ntp.org>
+
 ---
 (4.2.8p17) 2023/06/06 Released by Harlan Stenn <stenn@ntp.org>
 
diff --git a/include/ntp_lists.h b/include/ntp_lists.h
index d74197494..bed692ff2 100644
--- a/include/ntp_lists.h
+++ b/include/ntp_lists.h
@@ -181,7 +181,7 @@ do {								\
 
 #define UNLINK_EXPR_SLIST(punlinked, listhead, expr, nextlink,	\
 			  entrytype)				\
-do {								\
+if (NULL != (listhead)) {					\
 	entrytype **ppentry;					\
 								\
 	ppentry = &(listhead);					\
@@ -202,6 +202,8 @@ do {								\
 	} else {						\
 		(punlinked) = NULL;				\
 	}							\
+} else do {							\
+	(punlinked) = NULL;					\
 } while (FALSE)
 
 #define UNLINK_SLIST(punlinked, listhead, ptounlink, nextlink,	\