From 38b0920e376b236ea0b56686d08a4ef49b4bfcbe Mon Sep 17 00:00:00 2001 From: =?utf8?q?David=20H=C3=A4rdeman?= Date: Sun, 23 Nov 2025 14:53:35 +0100 Subject: [PATCH] config: fix realloc() error handling for "dhcpv6_raw" option MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Check the return value from realloc() to avoid leaking memory. Signed-off-by: David Härdeman Link: https://github.com/openwrt/odhcpd/pull/320 Signed-off-by: Álvaro Fernández Rojas --- src/config.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/config.c b/src/config.c index 6a87960..53362b5 100644 --- a/src/config.c +++ b/src/config.c @@ -1417,8 +1417,15 @@ int config_parse_interface(void *data, size_t len, const char *name, bool overwr iface->dhcpv4_forcereconf = blobmsg_get_bool(c); if ((c = tb[IFACE_ATTR_DHCPV6_RAW])) { - iface->dhcpv6_raw_len = blobmsg_data_len(c) / 2; - iface->dhcpv6_raw = realloc(iface->dhcpv6_raw, iface->dhcpv6_raw_len); + void *tmp; + size_t opt_len = blobmsg_data_len(c) / 2; + + tmp = realloc(iface->dhcpv6_raw, opt_len); + if (!tmp) + goto err; + + iface->dhcpv6_raw = tmp; + iface->dhcpv6_raw_len = opt_len; odhcpd_unhexlify(iface->dhcpv6_raw, iface->dhcpv6_raw_len, blobmsg_get_string(c)); } -- 2.30.2