From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 9 Aug 2023 20:08:23 +0000 (+0900)
Subject: udev-builtin-net_id: fix potential invalid memory access
X-Git-Tag: v255-rc1~758^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c27d9c0ac19db7a7b18f124f917cd0e0fa95ecda;p=thirdparty%2Fsystemd.git

udev-builtin-net_id: fix potential invalid memory access

Follow-up for 28141620d963c0c490d409d6ec6ff5f143357124.

Addresses post-merge review in #28269.
---

diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c
index e82285b5ff2..156802f2965 100644
--- a/src/udev/udev-builtin-net_id.c
+++ b/src/udev/udev-builtin-net_id.c
@@ -702,18 +702,14 @@ static int names_platform(sd_device *dev, const char *prefix, bool test) {
         /* Platform devices are named after ACPI table match, and instance id
          * eg. "/sys/devices/platform/HISI00C2:00"
          * The Vendor (3 or 4 char), followed by hexadecimal model number : instance id. */
-        if (p[7] == ':') {
+        if (r == 10 && p[7] == ':') {
                 /* 3 char vendor string */
-                if (r != 10)
-                        return -EINVAL;
                 vendor = strndupa(p, 3);
                 model_str = strndupa(p + 3, 4);
                 instance_str = strndupa(p + 8, 2);
                 validchars = UPPERCASE_LETTERS;
-        } else if (p[8] == ':') {
+        } else if (r == 11 && p[8] == ':') {
                 /* 4 char vendor string */
-                if (r != 11)
-                        return -EINVAL;
                 vendor = strndupa(p, 4);
                 model_str = strndupa(p + 4, 4);
                 instance_str = strndupa(p + 9, 2);