From 825aa0c093d6c0b4f81a95cd2320331a5b5adae6 Mon Sep 17 00:00:00 2001 From: David Bauer Date: Sat, 3 Jul 2021 01:22:40 +0200 Subject: [PATCH] respondd-module-airtime: fix null pointer deref In case a radio exists, but is disabled, the survey request will return successfully, but without data. The code could not handle this case, as the newest_element_index would be negative in this case, leading to json_object_array_get_idx returning a null-pointer. Check for a null pointer prior adding the PHY index, avoiding a null-pointer dereference. Signed-off-by: David Bauer --- net/respondd-module-airtime/src/respondd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/respondd-module-airtime/src/respondd.c b/net/respondd-module-airtime/src/respondd.c index 4423b10..eaf8182 100644 --- a/net/respondd-module-airtime/src/respondd.c +++ b/net/respondd-module-airtime/src/respondd.c @@ -26,9 +26,10 @@ static struct json_object *respondd_provider_statistics(void) { while (ifaces != NULL) { ok = get_airtime(wireless, ifaces->ifx); if (ok) { - newest_element_index = json_object_array_length(wireless)-1; + newest_element_index = json_object_array_length(wireless) - 1; last = json_object_array_get_idx(wireless, newest_element_index); - json_object_object_add(last, "phy", json_object_new_int(ifaces->wiphy)); + if (last) + json_object_object_add(last, "phy", json_object_new_int(ifaces->wiphy)); } void *freeptr = ifaces; ifaces = ifaces->next;