Security Vulnerability: NULL Pointer Dereference (Medium)
Description
In generateAircraftJson, when the output buffer is full, the code doubles its size via realloc. If realloc returns NULL (out of memory), the code dereferences the NULL pointer, causing a crash.
Location
net_io.c:1862-1870
Vulnerable Code
When (p + 10) >= end, the code calls realloc(buf, buflen*2). If this returns NULL, the subsequent pointer assignments cause a segfault.
Attack Vector
A receiver tracking a very large number of aircraft or running on a memory-constrained device can trigger this when the JSON output exceeds the initial 32KB buffer.
Impact
- Crash / denial of service
- Loss of tracking data
Suggested Fix
Check the realloc return value before using the pointer. Save the old buffer pointer since realloc does not free the original on failure.
Security Vulnerability: NULL Pointer Dereference (Medium)
Description
In generateAircraftJson, when the output buffer is full, the code doubles its size via realloc. If realloc returns NULL (out of memory), the code dereferences the NULL pointer, causing a crash.
Location
net_io.c:1862-1870
Vulnerable Code
When (p + 10) >= end, the code calls realloc(buf, buflen*2). If this returns NULL, the subsequent pointer assignments cause a segfault.
Attack Vector
A receiver tracking a very large number of aircraft or running on a memory-constrained device can trigger this when the JSON output exceeds the initial 32KB buffer.
Impact
Suggested Fix
Check the realloc return value before using the pointer. Save the old buffer pointer since realloc does not free the original on failure.