[PATCH] net/route: Fix NULL pointer dereference when deleting last route

[PATCH] net/route: Fix NULL pointer dereference when deleting last route

[Jeremy Kerr]

Currently, grub_cmd_delroute will crash when deleting the last route.
In the deletion code, we remove the matching route from the route list:
      
  *prev = route->next
      
- route->next being NULL to mark the end of the list. We then process
the for loop's iterator, which contains:

  prev = &((*prev)->next)

ie,

  prev = NULL->next;

Instead, break out of the for-loop when we've deleted the route.

	* grub-core/net/net.c (grub_cmd_delroute): fix NULL deref when deleting
	last route

---
 grub-core/net/net.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/grub-core/net/net.c b/grub-core/net/net.c
index 09acea9..cafec41 100644
--- a/grub-core/net/net.c
+++ b/grub-core/net/net.c
@@ -430,6 +430,7 @@ grub_cmd_delroute (struct grub_command *cmd __attribute__ ((unused)),
 	*prev = route->next;
 	grub_free (route->name);
 	grub_free (route);
+	break;
       }
 
   return GRUB_ERR_NONE;

Re: [PATCH] net/route: Fix NULL pointer dereference when deleting last route

[Vladimir 'φ-coder/phcoder' Serbinenko]

On 06.12.2011 10:42, Jeremy Kerr wrote:
> Currently, grub_cmd_delroute will crash when deleting the last route.
> In the deletion code, we remove the matching route from the route list:
>
>    *prev = route->next
>
> - route->next being NULL to mark the end of the list. We then process
> the for loop's iterator, which contains:
>
>    prev =&((*prev)->next)
>
> ie,
>
>    prev = NULL->next;
>
> Instead, break out of the for-loop when we've deleted the route.
>
> 	* grub-core/net/net.c (grub_cmd_delroute): fix NULL deref when deleting
> 	last route
Bug is real but fix is wrong. Committed the right fix.
> ---
>   grub-core/net/net.c |    1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/grub-core/net/net.c b/grub-core/net/net.c
> index 09acea9..cafec41 100644
> --- a/grub-core/net/net.c
> +++ b/grub-core/net/net.c
> @@ -430,6 +430,7 @@ grub_cmd_delroute (struct grub_command *cmd __attribute__ ((unused)),
>   	*prev = route->next;
>   	grub_free (route->name);
>   	grub_free (route);
> +	break;
>         }
>
>     return GRUB_ERR_NONE;
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>


-- 
Regards
Vladimir 'φ-coder/phcoder' Serbinenko