From: Alexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Date: Wed, 22 Jul 2026 19:41:06 +0000 (-0400)
Subject: lib/unlang/xlat_alloc: check tmpl_copy() failure in _xlat_copy_internal (NULL deref)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5394d735f01c3eddeefe6d6ef13c9043dddcbc40;p=thirdparty%2Ffreeradius-server.git

lib/unlang/xlat_alloc: check tmpl_copy() failure in _xlat_copy_internal (NULL deref)
---

diff --git a/src/lib/unlang/xlat_alloc.c b/src/lib/unlang/xlat_alloc.c
index a1a34d3c31f..1dee6a512a5 100644
--- a/src/lib/unlang/xlat_alloc.c
+++ b/src/lib/unlang/xlat_alloc.c
@@ -409,7 +409,7 @@ static int CC_HINT(nonnull) _xlat_copy_internal(NDEBUG_LOCATION_ARGS TALLOC_CTX
 			break;
 
 		case XLAT_TMPL:
-			node->vpt = tmpl_copy(node, p->vpt);
+			if (unlikely(!(node->vpt = tmpl_copy(node, p->vpt)))) goto error;
 			break;
 
 #ifdef HAVE_REGEX