mdns: Add null check for pbuf_skip

ArduPilot · May 11, 2023 · e3a20b3 · e3a20b3
1 parent 1c5cc7b
commit e3a20b3
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/apps/mdns/mdns.c b/src/apps/mdns/mdns.c
@@ -1889,6 +1889,10 @@ mdns_handle_response(struct mdns_packet *pkt, struct netif *netif)
           flags = MDNS_SEARCH_RESULT_FIRST | MDNS_SEARCH_RESULT_LAST;
       }
       p = pbuf_skip(pkt->pbuf, ans.rd_offset, &offset);
+      if (p == NULL) {
+        LWIP_DEBUGF(MDNS_DEBUG, ("MDNS: Malformed response packet, aborting\n"));
+        return;
+      }
       if (ans.info.type == DNS_RRTYPE_PTR || ans.info.type == DNS_RRTYPE_SRV) {
         /* Those RR types have compressed domain name. Must uncompress here,
            since cannot be done without pbuf. */

diff --git a/src/core/pbuf.c b/src/core/pbuf.c
@@ -1203,7 +1203,7 @@ pbuf_skip_const(const struct pbuf *in, u16_t in_offset, u16_t *out_offset)
  * @param in input pbuf
  * @param in_offset offset to skip
  * @param out_offset resulting offset in the returned pbuf
- * @return the pbuf in the queue where the offset is
+ * @return the pbuf in the queue where the offset is or NULL when the offset is too high
  */
 struct pbuf *
 pbuf_skip(struct pbuf *in, u16_t in_offset, u16_t *out_offset)