refstr: be extra careful about calling memcpy() with dangling pointerth/refstr-inline

1 files changed, 5 insertions, 1 deletions

diff --git a/src/libnm-glib-aux/nm-ref-string.c b/src/libnm-glib-aux/nm-ref-string.c
index 6fb39024e6..93e97c7931 100644
--- a/src/libnm-glib-aux/nm-ref-string.c
+++ b/src/libnm-glib-aux/nm-ref-string.c
@@ -44,7 +44,11 @@ _ref_string_equal(gconstpointer ptr_a, gconstpointer ptr_b)
     _ref_string_get(ptr_a, &cstr_a, &len_a);
     _ref_string_get(ptr_b, &cstr_b, &len_b);
 
-    return len_a == len_b && memcmp(cstr_a, cstr_b, len_a) == 0;
+    /* memcmp() accepts "n=0" argument, but it's not clear whether in that case
+     * all pointers must still be valid. The input pointer might be provided by
+     * the user via nm_ref_string_new_len(), and for len=0 we want to allow
+     * also invalid pointers. Hence, this extra "len_a==0" check. */
+    return len_a == len_b && (len_a == 0 || (memcmp(cstr_a, cstr_b, len_a) == 0));
 }
 
 /*****************************************************************************/