From: Qiumiao Zhang Date: Sat, 16 Apr 2022 01:50:11 +0000 (+0800) Subject: net: Fix NULL pointer dereference when parsing ICMP6_ROUTER_ADVERTISE messages X-Git-Tag: grub-2.12-rc1~388 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63d3211403fad20a6431562bcaab01751ae4c00f;p=thirdparty%2Fgrub.git net: Fix NULL pointer dereference when parsing ICMP6_ROUTER_ADVERTISE messages During UEFI PXE boot in IPv6 network, if the DHCP server adopts stateful automatic configuration, then the client receives a ICMP6_ROUTER_ADVERTISE multicast message from the server. This may be received without the interface having a configured network address, so orig_inf will be NULL, which can lead to a NULL dereference when creating the default route. Actually, in this case, the client obtains the default route through DHCPv6 instead of RA messages. So if orig_inf == NULL and route_inf == NULL, we should not set the default route. Fixes: https://savannah.gnu.org/bugs/?62072 Signed-off-by: Qiumiao Zhang Reviewed-by: Daniel Kiper --- diff --git a/grub-core/net/icmp6.c b/grub-core/net/icmp6.c index 986d57b01..9a8c45112 100644 --- a/grub-core/net/icmp6.c +++ b/grub-core/net/icmp6.c @@ -477,7 +477,7 @@ grub_net_recv_icmp6_packet (struct grub_net_buff *nb, /* May not have gotten slaac info, find a global address on this card. */ - if (route_inf == NULL) + if (route_inf == NULL && orig_inf != NULL) { FOR_NET_NETWORK_LEVEL_INTERFACES (inf) {