From 7aa9d92600ad3563edc1f0e269e6a75176cb0a3a Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Mon, 6 Apr 2026 17:10:00 -0700 Subject: [PATCH] [mac] fix nullptr-with-nonzero-offset in ProcessEnhAckProbing (#12842) This commit fixes a nullptr-with-nonzero-offset runtime error in Mac::ProcessEnhAckProbing. The error occurred because pointer arithmetic was performed on the enhAckProbingIe pointer before verifying if it was null. The fix moves the pointer calculation after the null check to ensure that it is only performed when a valid IE is present. This was discovered by ASAN/UBSAN when processing frames without the Enhancement ACK Probing IE. --- src/core/mac/mac.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/core/mac/mac.cpp b/src/core/mac/mac.cpp index 37cc5e523..5a34e3670 100644 --- a/src/core/mac/mac.cpp +++ b/src/core/mac/mac.cpp @@ -2530,16 +2530,16 @@ void Mac::ProcessEnhAckProbing(const RxFrame &aFrame, const Neighbor &aNeighbor) const HeaderIe *enhAckProbingIe = reinterpret_cast(aFrame.GetThreadIe(ThreadIe::kEnhAckProbingIe)); - const uint8_t *data = - reinterpret_cast(enhAckProbingIe) + sizeof(HeaderIe) + sizeof(VendorIeHeader); - uint8_t dataLen = 0; + uint8_t dataLen; VerifyOrExit(enhAckProbingIe != nullptr); dataLen = enhAckProbingIe->GetLength() - sizeof(VendorIeHeader); VerifyOrExit(dataLen <= kEnhAckProbingIeMaxLen); - Get().ProcessEnhAckIeData(data, dataLen, aNeighbor); + Get().ProcessEnhAckIeData(reinterpret_cast(enhAckProbingIe) + + sizeof(HeaderIe) + sizeof(VendorIeHeader), + dataLen, aNeighbor); exit: return; }