Skip to content

Commit 45cb2b1

Browse files
morehousecdecker
authored andcommitted
db: avoid calling memcpy on NULL
It is possible for db_column_bytes() to return 0 and for db_column_blob() to return NULL even when db_column_is_null() returns false. We need to short circuit in this case. Detected by UBSan: db/bindings.c:479:12: runtime error: null pointer passed as argument 2, which is declared to never be null /usr/include/string.h:44:28: note: nonnull attribute specified here #0 0x95f117 in db_col_arr_ db/bindings.c:479:2 #1 0x95ef85 in db_col_channel_type db/bindings.c:459:32 #2 0x852c03 in wallet_stmt2channel wallet/wallet.c:1483:9 #3 0x81f396 in wallet_channels_load_active wallet/wallet.c:1749:23 #4 0x81f03d in wallet_init_channels wallet/wallet.c:1765:9 #5 0x72f1f9 in load_channels_from_wallet lightningd/peer_control.c:2257:7 #6 0x672856 in main lightningd/lightningd.c:1121:25
1 parent a5afb4f commit 45cb2b1

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

db/bindings.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -490,7 +490,8 @@ void *db_col_arr_(const tal_t *ctx, struct db_stmt *stmt, const char *colname,
490490
caller, colname, col, sourcelen, label, bytes);
491491

492492
p = tal_arr_label(ctx, char, sourcelen, label);
493-
memcpy(p, db_column_blob(stmt, col), sourcelen);
493+
if (sourcelen != 0)
494+
memcpy(p, db_column_blob(stmt, col), sourcelen);
494495
return p;
495496
}
496497

0 commit comments

Comments
 (0)