From 0cf9e37eb8b9aa12a742d268c0b2d595f9398fad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fl=C3=A1vio=20J=2E=20Saraiva?= Date: Thu, 28 Mar 2024 10:53:03 +0000 Subject: [PATCH] Fix null dereference in cmd_send_aux_msg. --- stable/hv_vm.c | 4 ++++ unstable/hv_vm.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/stable/hv_vm.c b/stable/hv_vm.c index a3682f732..e8de81d70 100644 --- a/stable/hv_vm.c +++ b/stable/hv_vm.c @@ -914,6 +914,10 @@ static int cmd_send_aux_msg(hypervisor_conn_t *conn,int argc,char *argv[]) } else if (strcmp(format,"base64") == 0 && len >= 0) { data = malloc(len+1); + if (data == NULL) { + hypervisor_send_reply(conn,HSC_ERR_UNSPECIFIED,1,"out of memory"); + return(-1); + } len = base64_decode((unsigned char*)data,(const unsigned char *)argv[1],len); written = vtty_store_data(vm->vtty_aux,data,len); free(data); diff --git a/unstable/hv_vm.c b/unstable/hv_vm.c index 70f18fbf0..7ab16f6ac 100644 --- a/unstable/hv_vm.c +++ b/unstable/hv_vm.c @@ -935,6 +935,10 @@ static int cmd_send_aux_msg(hypervisor_conn_t *conn,int argc,char *argv[]) } else if (strcmp(format,"base64") == 0 && len >= 0) { data = malloc(len+1); + if (data == NULL) { + hypervisor_send_reply(conn,HSC_ERR_UNSPECIFIED,1,"out of memory"); + return(-1); + } len = base64_decode((unsigned char*)data,(const unsigned char *)argv[1],len); written = vtty_store_data(vm->vtty_aux,data,len); free(data);