netlink-socket: Fix possiblity of nl_transact dereferencing null pointer

Many nl_transact callers and its wrapper tc_transact pass NULL for replyp
which is being accessed in error flow without being checked if null or not.

Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>

diff --git a/lib/netlink-socket.c b/lib/netlink-socket.c
index 7502764de006a824ac8b700554d00c54945d3cf5..e45914c32870a51fbf7f67e991ee1ba56fe0bea4 100644 (file)
--- a/lib/netlink-socket.c
+++ b/lib/netlink-socket.c
@@ -1698,7 +1698,9 @@ nl_transact(int protocol, const struct ofpbuf *request,
 
     error = nl_pool_alloc(protocol, &sock);
     if (error) {
-        *replyp = NULL;
+        if (replyp) {
+            *replyp = NULL;
+        }
         return error;
     }