ovs_stats: fix potential NULL array dereference

In ovs_stats_update_bridge(), YAJL_GET_ARRAY() may return a NULL
pointer. Ensure that a non-NULL pointer is returned, before
attempting to dererence same.

Fixes: 4256753 ("ovs_events: fix scan-build warnings #2205")
Signed-off-by: Mark Kavanagh <mark.b.kavanagh@intel.com>

diff --git a/src/ovs_stats.c b/src/ovs_stats.c
index f56e12b..f513e72 100644 (file)
--- a/src/ovs_stats.c
+++ b/src/ovs_stats.c
@@ -360,14 +360,18 @@ static int ovs_stats_update_bridge(yajl_val bridge) {
           yajl_val *array = YAJL_GET_ARRAY(br_ports)->values;
           size_t array_len = YAJL_GET_ARRAY(br_ports)->len;
           if (array != NULL && array_len > 0 && YAJL_IS_ARRAY(array[1])) {
-            yajl_val *ports_arr = YAJL_GET_ARRAY(array[1])->values;
-            size_t ports_num = YAJL_GET_ARRAY(array[1])->len;
-            for (size_t i = 0; i < ports_num && ports_arr != NULL; i++) {
-              tmp = YAJL_GET_STRING(ports_arr[i]->u.array.values[1]);
-              if (tmp != NULL)
-                ovs_stats_new_port(br, tmp);
-              else
-                goto failure;
+            if (YAJL_GET_ARRAY(array[1]) == NULL)
+              goto failure;
+            else {
+              yajl_val *ports_arr = YAJL_GET_ARRAY(array[1])->values;
+              size_t ports_num = YAJL_GET_ARRAY(array[1])->len;
+              for (size_t i = 0; i < ports_num && ports_arr != NULL; i++) {
+                tmp = YAJL_GET_STRING(ports_arr[i]->u.array.values[1]);
+                if (tmp != NULL)
+                  ovs_stats_new_port(br, tmp);
+                else
+                  goto failure;
+              }
             }
           }
         } else