From: David Härdeman <david@hardeman.nu>
Date: Sun, 23 Nov 2025 13:53:35 +0000 (+0100)
Subject: config: fix realloc() error handling for "dhcpv6_raw" option
X-Git-Url: http://git.openwrt.org/?a=commitdiff_plain;h=38b0920e376b236ea0b56686d08a4ef49b4bfcbe;p=project%2Fodhcpd.git

config: fix realloc() error handling for "dhcpv6_raw" option

Check the return value from realloc() to avoid leaking memory.

Signed-off-by: David Härdeman <david@hardeman.nu>
Link: https://github.com/openwrt/odhcpd/pull/320
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
---

diff --git a/src/config.c b/src/config.c
index 6a87960..53362b5 100644
--- a/src/config.c
+++ b/src/config.c
@@ -1417,8 +1417,15 @@ int config_parse_interface(void *data, size_t len, const char *name, bool overwr
 		iface->dhcpv4_forcereconf = blobmsg_get_bool(c);
 
 	if ((c = tb[IFACE_ATTR_DHCPV6_RAW])) {
-		iface->dhcpv6_raw_len = blobmsg_data_len(c) / 2;
-		iface->dhcpv6_raw = realloc(iface->dhcpv6_raw, iface->dhcpv6_raw_len);
+		void *tmp;
+		size_t opt_len = blobmsg_data_len(c) / 2;
+
+		tmp = realloc(iface->dhcpv6_raw, opt_len);
+		if (!tmp)
+			goto err;
+
+		iface->dhcpv6_raw = tmp;
+		iface->dhcpv6_raw_len = opt_len;
 		odhcpd_unhexlify(iface->dhcpv6_raw, iface->dhcpv6_raw_len, blobmsg_get_string(c));
 	}