From 8a0e7b8c4e02f0b5cc058b69b14c2261db9c1cea Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Sun, 25 Apr 2021 21:41:34 -0700 Subject: [PATCH] [dua-manager] avoid null dereference in CoAP response handler (#6509) This commit changes `DuaManager::HandleDuaResponse()` to use a pointer to `aMessage` and `aMessageInfo` (instead of reference) Note that in case of a failure, the `Coap` module may invoke the response handler with `nullptr` for these parameters. --- src/core/thread/dua_manager.cpp | 8 +++++--- src/core/thread/dua_manager.hpp | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/src/core/thread/dua_manager.cpp b/src/core/thread/dua_manager.cpp index 99ebee1b9..8feeb9e5f 100644 --- a/src/core/thread/dua_manager.cpp +++ b/src/core/thread/dua_manager.cpp @@ -538,7 +538,7 @@ exit: otLogInfoDua("Sent DUA.req for DUA %s: %s", dua.ToString().AsCString(), ErrorToString(error)); } -void DuaManager::HandleDuaResponse(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo, Error aResult) +void DuaManager::HandleDuaResponse(Coap::Message *aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult) { OT_UNUSED_VARIABLE(aMessageInfo); Error error; @@ -552,10 +552,12 @@ void DuaManager::HandleDuaResponse(Coap::Message &aMessage, const Ip6::MessageIn } VerifyOrExit(aResult == kErrorNone, error = kErrorParse); - VerifyOrExit(aMessage.GetCode() == Coap::kCodeChanged || aMessage.GetCode() >= Coap::kCodeBadRequest, + OT_ASSERT(aMessage != nullptr); + + VerifyOrExit(aMessage->GetCode() == Coap::kCodeChanged || aMessage->GetCode() >= Coap::kCodeBadRequest, error = kErrorParse); - error = ProcessDuaResponse(aMessage); + error = ProcessDuaResponse(*aMessage); exit: if (error != kErrorResponseTimeout) diff --git a/src/core/thread/dua_manager.hpp b/src/core/thread/dua_manager.hpp index a1056350e..bc268fb86 100644 --- a/src/core/thread/dua_manager.hpp +++ b/src/core/thread/dua_manager.hpp @@ -201,10 +201,10 @@ private: static void HandleDuaResponse(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo, Error aResult) { static_cast(aContext)->HandleDuaResponse( - *static_cast(aMessage), *static_cast(aMessageInfo), aResult); + static_cast(aMessage), static_cast(aMessageInfo), aResult); } - void HandleDuaResponse(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo, Error aResult); + void HandleDuaResponse(Coap::Message *aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult); static void HandleDuaNotification(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo) {