From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Tue, 2 May 2017 02:57:09 +0000 (-0400)
Subject: Don’t segv on zero length boxes in value_box_copy
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=34c551b7dec7ae39e241a107d852eac8cfe40066;p=thirdparty%2Ffreeradius-server.git

Don’t segv on zero length boxes in value_box_copy
---

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 98cb1ee729c..7ccf58803c6 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -1626,8 +1626,11 @@ inline int value_box_copy(TALLOC_CTX *ctx, value_box_t *dst, const value_box_t *
 
 	case PW_TYPE_STRING:
 	{
-		char *str;
+		char *str = NULL;
 
+		/*
+		 *	Zero length strings still have a one byte buffer
+		 */
 		str = talloc_bstrndup(ctx, src->datum.strvalue, src->length);
 		if (!str) {
 			fr_strerror_printf("Failed allocating string buffer");
@@ -1639,11 +1642,16 @@ inline int value_box_copy(TALLOC_CTX *ctx, value_box_t *dst, const value_box_t *
 
 	case PW_TYPE_OCTETS:
 	{
-		uint8_t *bin;
+		uint8_t *bin = NULL;
 
-		bin = talloc_memdup(ctx, src->datum.octets, src->length);
-		talloc_set_type(bin, uint8_t);
-		if (!bin) return -1;
+		if (src->length) {
+			bin = talloc_memdup(ctx, src->datum.octets, src->length);
+			if (!bin) {
+				fr_strerror_printf("Failed allocating octets buffer");
+				return -1;
+			}
+			talloc_set_type(bin, uint8_t);
+		}
 		dst->datum.octets = bin;
 	}
 		break;