Fix an accesslist reload issue where an empty-but-present changeset after a reload could potentially walk a NULL array

1 files changed, 9 insertions, 3 deletions

diff --git a/src/ot_accesslist.c b/src/ot_accesslist.c
index 0597e9a..487597e 100644
--- a/src/ot_accesslist.c
+++ b/src/ot_accesslist.c
@@ -353,11 +353,17 @@ static void     *accesslist_adddel_worker(const char *fifoname, ot_accesslist *_
         /* Only if the info hash is not in the adding_to list, create a new head with that entry */
         if (!exactmatch) {
           ot_accesslist *accesslist_new = accesslist_make(*adding_to, (*adding_to)->size + 1);
-          ptrdiff_t      off            = insert_point - (*adding_to)->list;
           if (accesslist_new) {
-            memcpy(accesslist_new->list, (*adding_to)->list, sizeof(ot_hash) * off);
+            ptrdiff_t off   = (*adding_to)->size ? insert_point - (*adding_to)->list : 0;
+            size_t    after = (*adding_to)->size - off;
+
+            /* A reload leaves an empty list with no array at all, and memcpy
+               may not be handed a null pointer even for nothing */
+            if (off)
+              memcpy(accesslist_new->list, (*adding_to)->list, sizeof(ot_hash) * off);
             memcpy(accesslist_new->list + off, info_hash, sizeof(info_hash));
-            memcpy(accesslist_new->list + off + 1, (*adding_to)->list + off, sizeof(ot_hash) * ((*adding_to)->size - off));
+            if (after)
+              memcpy(accesslist_new->list + off + 1, (*adding_to)->list + off, sizeof(ot_hash) * after);
             (*adding_to)->base = time_now_minutes();
             *adding_to = accesslist_new;
           }