libevent/libevent — pull request #148 by kuldeepgupta-samsung (2014-06-27 07:37:07+00:00)
Title: Update event_tagging.c

In function decode_tag_internal
static int decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain)
{...
data = evbuffer_pullup(evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1);
//evbuffer_pullup may return null.
//data is used below which causes dereferencing null
while (count++ < len) {
ev_uint8_t lower = *data++;
//dereference: Incrementing a pointer which might be null: data might be null.
number |= (lower & 0x7f) << shift;
shift += 7;

if (!(lower & 0x80)) {
done = 1;
break;
}
}
To resolve this checking data in while loop
line no 211
while (count++ < len) {
is replaced with
while (count++ < len && data) {