From: Oliver Kurth <okurth@vmware.com>
Date: Tue, 29 Jan 2019 22:03:19 +0000 (-0800)
Subject: Fix some bad derefs in primary NIC gather code
X-Git-Tag: stable-10.3.10~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=74d165bab17132b50d909b7f2e5cb19f3f140a01;p=thirdparty%2Fopen-vm-tools.git

Fix some bad derefs in primary NIC gather code

Found by user in https://github.com/vmware/open-vm-tools/issues/272

Debug code tries to access a struct field that may not be init'd.
Pointer deref'd without a sanity check.
---

diff --git a/open-vm-tools/lib/nicInfo/nicInfoPosix.c b/open-vm-tools/lib/nicInfo/nicInfoPosix.c
index a22981d5a..83569816e 100644
--- a/open-vm-tools/lib/nicInfo/nicInfoPosix.c
+++ b/open-vm-tools/lib/nicInfo/nicInfoPosix.c
@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 2014-2018 VMware, Inc. All rights reserved.
+ * Copyright (C) 2014-2019 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU Lesser General Public License as published
@@ -377,7 +377,7 @@ GuestInfoGetNicInfo(unsigned int maxIPv4Routes,
 
    /* Get a handle to read the network interface configuration details. */
    if ((intf = intf_open()) == NULL) {
-      g_debug("Error, failed NULL result from intf_open()\n");
+      g_warning("%s: intf_open() failed\n", __FUNCTION__);
       return FALSE;
    }
 
@@ -484,7 +484,15 @@ GuestInfoGetPrimaryIP(void)
     * the first non-loopback, internet interface in the interface list.
     */
    for (curr = ifaces; curr != NULL; curr = curr->ifa_next) {
-      int currFamily = ((struct sockaddr_storage *)curr->ifa_addr)->ss_family;
+      int currFamily;
+
+      /*
+       * Some interfaces ("tun") have no ifa_addr, so ignore them.
+       */
+      if (NULL == curr->ifa_addr) {
+         continue;
+      }
+      currFamily = ((struct sockaddr_storage *)curr->ifa_addr)->ss_family;
 
       if (!(curr->ifa_flags & IFF_UP) || curr->ifa_flags & IFF_LOOPBACK) {
          continue;
@@ -518,6 +526,7 @@ GuestInfoGetPrimaryIP(void)
 }
 
 #else
+
 #ifndef NO_DNET
 
 char *
@@ -526,20 +535,24 @@ GuestInfoGetPrimaryIP(void)
    GuestInfoIpPriority ipp;
    intf_t *intf = intf_open();
 
-   if (intf != NULL) {
-      ipp.ipstr = NULL;
-      for (ipp.priority = NICINFO_PRIORITY_PRIMARY;
-          ipp.priority < NICINFO_PRIORITY_MAX;
-          ipp.priority++){
-         intf_loop(intf, GuestInfoGetIntf, &ipp);
-         if (ipp.ipstr != NULL) {
-            break;
-         }
+   if (NULL == intf) {
+      g_warning("%s: intf_open() failed\n", __FUNCTION__);
+      return NULL;
+   }
+
+   ipp.ipstr = NULL;
+   for (ipp.priority = NICINFO_PRIORITY_PRIMARY;
+       ipp.priority < NICINFO_PRIORITY_MAX;
+       ipp.priority++){
+      intf_loop(intf, GuestInfoGetIntf, &ipp);
+      if (ipp.ipstr != NULL) {
+         break;
       }
-      intf_close(intf);
    }
+   intf_close(intf);
 
-   g_debug("%s: returning '%s'", __FUNCTION__, ipp.ipstr);
+   g_debug("%s: returning '%s'",
+           __FUNCTION__, ipp.ipstr ? ipp.ipstr : "<null>");
 
    return ipp.ipstr;
 }