[OpenWrt-Devel] [PATCH][opkg-lede] libopkg: Fix segfault on trailing comma in deps

[Patrick McDermott]

A "Depends" or other package relationship field with a trailing comma
(followed by zero or more whitespace characters) in any package feed
list will cause opkg after commit 98ce8c2 ("pkg: convert most other
struct members into dynamic blob buffer fields") to segfault.

In the case of a trailing comma, parseDepends() has always been called
with a string containing only the whitespace (if any) following the
comma, and previously a copy loop extracted the dependency package name
as an empty string.  Now, strtok() returns NULL as the package name,
which is passed through ensure_abstract_pkg_by_name(),
abstract_pkg_fetch_by_name(), hash_table_get(), hash_index(), and
finally djb2_hash() which dereferences the NULL pointer.

Signed-off-by: Patrick McDermott <patrick.mcdermott at libiquity.com>
---
 libopkg/pkg_depends.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libopkg/pkg_depends.c b/libopkg/pkg_depends.c
index 3abdcd3..6d075f2 100644
--- a/libopkg/pkg_depends.c
+++ b/libopkg/pkg_depends.c
@@ -1025,6 +1025,8 @@ static int parseDepends(compound_depend_t * compound_depend, char *depend_str, e
 
 	for (i = 0, depend = strtok_r(depend_str, "|", &tok); depend; i++, depend = strtok_r(NULL, "|", &tok)) {
 		name = strtok(depend, " ");
+		if (!name)
+			break;
 		rest = strtok(NULL, "\n");
 
 		tmp = realloc(possibilities, sizeof(tmp) * (i + 1));
-- 
2.11.0


_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel