diff options
| author | Michael Brown | 2017-03-21 13:57:36 +0100 |
|---|---|---|
| committer | Michael Brown | 2017-03-21 13:57:36 +0100 |
| commit | 64de7dc7fd06470424bb4c3ea537f542c46895c4 (patch) | |
| tree | 33058972646dfc944fa4155a2e19da5eb7ad4d85 /src/net | |
| parent | [slam] Fix resource leak on error path (diff) | |
| download | ipxe-64de7dc7fd06470424bb4c3ea537f542c46895c4.tar.gz ipxe-64de7dc7fd06470424bb4c3ea537f542c46895c4.tar.xz ipxe-64de7dc7fd06470424bb4c3ea537f542c46895c4.zip | |
[slam] Avoid NULL pointer dereference in slam_pull_value()
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/net')
| -rw-r--r-- | src/net/udp/slam.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/src/net/udp/slam.c b/src/net/udp/slam.c index 61dd7d98..c165b4fb 100644 --- a/src/net/udp/slam.c +++ b/src/net/udp/slam.c @@ -400,12 +400,16 @@ static int slam_pull_value ( struct slam_request *slam, return -EINVAL; } - /* Read value */ + /* Strip value */ iob_pull ( iobuf, len ); - *value = ( *data & 0x1f ); - while ( --len ) { - *value <<= 8; - *value |= *(++data); + + /* Read value, if applicable */ + if ( value ) { + *value = ( *data & 0x1f ); + while ( --len ) { + *value <<= 8; + *value |= *(++data); + } } return 0; |