networkd-ndisc: add assert for DNSSL allocation overflow safety

Coverity flags ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1 as a
potential overflow. Domain names are protocol-bounded but add an
assert to make this explicit for static analyzers.

CID#1548066

Follow-up for 1e7a0e21c97ac1bbc743009e5ec8c12bc6200e19

diff --git a/src/network/networkd-ndisc.c b/src/network/networkd-ndisc.c
index 93965f52536ec1e8bcd1e3e0a94ff2b8fa2d7cf4..e6b03c0826cad1b61b83882ac2b3cf0c6bf4fd35 100644 (file)
--- a/src/network/networkd-ndisc.c
+++ b/src/network/networkd-ndisc.c
@@ -1909,6 +1909,8 @@ static int ndisc_router_process_dnssl(Link *link, sd_ndisc_router *rt, bool zero
                 _cleanup_free_ NDiscDNSSL *s = NULL;
                 NDiscDNSSL *dnssl;
 
+                /* Silence static analyzers */
+                assert(strlen(*j) <= SIZE_MAX - ALIGN(sizeof(NDiscDNSSL)) - 1);
                 s = malloc0(ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1);
                 if (!s)
                         return log_oom();