ubusd: fix more instances of missing length checks for patterns

More instances of the same bug fixed by commit d31effb4277bd5.

Reported-by: Karsten Sperling <[email protected]>
Signed-off-by: Felix Fietkau <[email protected]>

diff --git a/ubusd_acl.c b/ubusd_acl.c
index 0979b5efc11fa032b10f079e0ac4b087bb14eeca..a5429cd7f31ee4780935d85a12f62348ddf46560 100644 (file)
--- a/ubusd_acl.c
+++ b/ubusd_acl.c
@@ -307,6 +307,9 @@ ubusd_acl_alloc_obj(struct ubusd_acl_file *file, const char *obj)
        char *k;
        bool partial = false;
 
+       if (!len)
+               return NULL;
+
        if (obj[len - 1] == '*') {
                partial = true;
                len--;
@@ -339,6 +342,8 @@ ubusd_acl_add_access(struct ubusd_acl_file *file, struct blob_attr *obj)
                return;
 
        o = ubusd_acl_alloc_obj(file, blobmsg_name(obj));
+       if (!o)
+               return;
 
        o->methods = tb[ACL_ACCESS_METHODS];
        o->tags = tb[ACL_ACCESS_TAGS];
@@ -353,6 +358,9 @@ ubusd_acl_add_subscribe(struct ubusd_acl_file *file, const char *obj)
 {
        struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj);
 
+       if (!o)
+               return;
+
        o->subscribe = true;
 }
 
@@ -361,6 +369,9 @@ ubusd_acl_add_publish(struct ubusd_acl_file *file, const char *obj)
 {
        struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj);
 
+       if (!o)
+               return;
+
        o->publish = true;
 }
 
@@ -368,6 +379,9 @@ static void ubusd_acl_add_listen(struct ubusd_acl_file *file, const char *obj)
 {
        struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj);
 
+       if (!o)
+               return;
+
        o->listen = true;
 }
 
@@ -375,6 +389,9 @@ static void ubusd_acl_add_send(struct ubusd_acl_file *file, const char *obj)
 {
        struct ubusd_acl_obj *o = ubusd_acl_alloc_obj(file, obj);
 
+       if (!o)
+               return;
+
        o->send = true;
 }
 

diff --git a/ubusd_proto.c b/ubusd_proto.c
index 48de9b96141c8011061ac9ae7d9885d5a0eb6b12..31263dc7ac274b084b8b32eeaa99d377a81d171a 100644 (file)
--- a/ubusd_proto.c
+++ b/ubusd_proto.c
@@ -241,6 +241,9 @@ static int __ubusd_handle_lookup(struct ubus_client *cl,
 
        objpath = blob_data(attr[UBUS_ATTR_OBJPATH]);
        len = strlen(objpath);
+       if (!len)
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
        if (objpath[len - 1] != '*') {
                obj = avl_find_element(&path, objpath, obj, path);
                if (!obj)