Browse Source

libubus: check for non-NULL data before running callbacks

UBUS_MSG_INVOKE and UBUS_MSG_DATA can be sent without UBUS_ATTR_DATA
present. Most ubus users assume that the msg argument passed can never
be NULL, so this change prevents a crash

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau 5 years ago
parent
commit
884be45162
2 changed files with 9 additions and 1 deletions
  1. 6 1
      libubus-obj.c
  2. 3 0
      libubus-req.c

+ 6 - 1
libubus-obj.c

@@ -74,7 +74,7 @@ ubus_process_invoke(struct ubus_context *ctx, struct ubus_msghdr *hdr,
 
 	if (attrbuf[UBUS_ATTR_NO_REPLY])
 		no_reply = blob_get_int8(attrbuf[UBUS_ATTR_NO_REPLY]);
-		
+
 	req.peer = hdr->peer;
 	req.seq = hdr->seq;
 	req.object = obj->id;
@@ -94,6 +94,11 @@ ubus_process_invoke(struct ubus_context *ctx, struct ubus_msghdr *hdr,
 	goto send;
 
 found:
+	if (!attrbuf[UBUS_ATTR_DATA]) {
+		ret = UBUS_STATUS_INVALID_ARGUMENT;
+		goto send;
+	}
+
 	ret = obj->methods[method].handler(ctx, obj, &req,
 					   blob_data(attrbuf[UBUS_ATTR_METHOD]),
 					   attrbuf[UBUS_ATTR_DATA]);

+ 3 - 0
libubus-req.c

@@ -32,6 +32,9 @@ static void req_data_cb(struct ubus_request *req, int type, struct blob_attr *da
 		return;
 
 	attr = ubus_parse_msg(data);
+	if (!attr[UBUS_ATTR_DATA])
+		return;
+
 	req->data_cb(req, type, attr[UBUS_ATTR_DATA]);
 }