From: Petr Vaganov Date: Tue, 21 Jul 2026 09:56:29 +0000 (+0700) Subject: ipsecmod: fix possible deref on null after reply_find_answer_rrset() (#1476) X-Git-Tag: release-1.26.0rc1~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7133e0d32a12707e02bc827f5549bdc0489e27f5;p=thirdparty%2Funbound.git ipsecmod: fix possible deref on null after reply_find_answer_rrset() (#1476) Return value of a function 'reply_find_answer_rrset' is dereferenced at ipsecmod.c:438 without checking for NULL, but it is usually checked for this function (10/12). Found by the static analyzer Svace (ISP RAS). Signed-off-by: Petr Vaganov --- diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c index 2c146a775..d1c0d442f 100644 --- a/ipsecmod/ipsecmod.c +++ b/ipsecmod/ipsecmod.c @@ -294,6 +294,10 @@ call_hook(struct module_qstate* qstate, struct ipsecmod_qstate* iq, rrset_key = reply_find_answer_rrset(&qstate->return_msg->qinfo, qstate->return_msg->rep); + if(!rrset_key) { + log_err("ipsecmod: could not find answer rrset for A/AAAA"); + return 0; + } /* Double check that the records are indeed A/AAAA. * This should never happen as this function is only executed for A/AAAA * queries but make sure we don't pass anything other than A/AAAA to the @@ -475,6 +479,12 @@ ipsecmod_handle_query(struct module_qstate* qstate, * ipsecmod_max_ttl. */ rrset_key = reply_find_answer_rrset(&qstate->return_msg->qinfo, qstate->return_msg->rep); + if(!rrset_key) { + log_err("ipsecmod: reply-find-answer failed"); + errinf(qstate, "ipsecmod: reply-find-answer failed"); + ipsecmod_error(qstate, id); + return; + } rrset_data = (struct packed_rrset_data*)rrset_key->entry.data; if(rrset_data->ttl > (time_t)qstate->env->cfg->ipsecmod_max_ttl) { /* Update TTL for rrset to fixed value. */