From 97e58519bc946daabcadc531510497c3598961a1 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 20:25:39 +0100 Subject: Fix an accesslist reload issue where an empty-but-present changeset after a reload could potentially walk a NULL array --- src/ot_accesslist.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/ot_accesslist.c b/src/ot_accesslist.c index 0597e9a..487597e 100644 --- a/src/ot_accesslist.c +++ b/src/ot_accesslist.c @@ -353,11 +353,17 @@ static void *accesslist_adddel_worker(const char *fifoname, ot_accesslist *_ /* Only if the info hash is not in the adding_to list, create a new head with that entry */ if (!exactmatch) { ot_accesslist *accesslist_new = accesslist_make(*adding_to, (*adding_to)->size + 1); - ptrdiff_t off = insert_point - (*adding_to)->list; if (accesslist_new) { - memcpy(accesslist_new->list, (*adding_to)->list, sizeof(ot_hash) * off); + ptrdiff_t off = (*adding_to)->size ? insert_point - (*adding_to)->list : 0; + size_t after = (*adding_to)->size - off; + + /* A reload leaves an empty list with no array at all, and memcpy + may not be handed a null pointer even for nothing */ + if (off) + memcpy(accesslist_new->list, (*adding_to)->list, sizeof(ot_hash) * off); memcpy(accesslist_new->list + off, info_hash, sizeof(info_hash)); - memcpy(accesslist_new->list + off + 1, (*adding_to)->list + off, sizeof(ot_hash) * ((*adding_to)->size - off)); + if (after) + memcpy(accesslist_new->list + off + 1, (*adding_to)->list + off, sizeof(ot_hash) * after); (*adding_to)->base = time_now_minutes(); *adding_to = accesslist_new; } -- cgit v1.3