ucode-mod-bpf: fix missing resource pointer checks

uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau
2026-07-20 10:43:36 +02:00
parent ff41ddea1c
commit 3c5e204abe
+12
View File
@@ -520,6 +520,9 @@ uc_bpf_map_iter_next(uc_vm_t *vm, size_t nargs)
struct uc_bpf_map_iter *iter = uc_fn_thisval("bpf.map_iter");
uc_value_t *rv;
if (!iter)
err_return(EINVAL, NULL);
if (!iter->has_next)
return NULL;
@@ -536,6 +539,9 @@ uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
uint64_t intval;
uc_value_t *rv;
if (!iter)
err_return(EINVAL, NULL);
if (!iter->has_next)
return NULL;
@@ -561,6 +567,9 @@ uc_bpf_map_foreach(uc_vm_t *vm, size_t nargs)
void *key, *next;
bool ret = false;
if (!map)
err_return(EINVAL, NULL);
key = alloca(map->key_size);
next = alloca(map->key_size);
has_next = !bpf_map_get_next_key(map->fd.fd, NULL, next);
@@ -597,6 +606,9 @@ uc_bpf_obj_pin(uc_vm_t *vm, size_t nargs, const char *type)
struct uc_bpf_fd *f = uc_fn_thisval(type);
uc_value_t *path = uc_fn_arg(0);
if (!f)
err_return(EINVAL, NULL);
if (ucv_type(path) != UC_STRING)
err_return(EINVAL, NULL);