sys/net/gnrc_sixlowpan: fix a possible NULL ptr dereference

[maribu]

Contribution description

Due to a typo in a logical operation, a specifically crafted packet could cause a NULL ptr dereference. However, the affected code is only active when 6LoWPAN without IPv6 support is used, which is not expected to ever happen in any real world deployment.

Testing procedure

• this makes static analysis happy
• when not using IPv6 and receiving a packet with only header counting as type == GNRC_NETTYPE_UNDEF after the 6LoWPAN header, no NULL pointer dereference should occur

Issues/PRs references

None

[riot-ci]

Murdock results

✔️ PASSED

bc697dd sys/net/gnrc_sixlowpan: fix a possible NULL ptr dereference

Success	Failures	Total	Runtime
11004	0	11005	09m:24s

Artifacts

• Documentation preview

[miri64]

Shunting in favor of the release note PR

[kfessel]

you might want to remove the second condition part

[kfessel]

is that && (type == GNRC_NETTYPE_UNDEF) needed?

the type is set only only if the ptr->next->type is GNRC_NETTYPE_NETIF and then then loop is broken anyway (the for condition is not checked again and no code (e.g.: deref) is run.

Suggested change

	for (gnrc_pktsnip_t *ptr = pkt; (ptr && (type == GNRC_NETTYPE_UNDEF));
	for (gnrc_pktsnip_t *ptr = pkt; ptr;

[miri64]

It leads to an early exit (yes that's only one more pkt->next if the list is correct, but does not hurt).

[kfessel]

that code is not needed since you @miri64 worked around it in #10866 by adding the break

[kfessel]

I think we should go for a clean for loop (only one running variable and only that is checked) otherwise we will have a linter complain next.

it will also increase the readability ( and the for will probalbly fit in one line ;

but you can dismiss this (thats what the ? is for).

[kfessel]

It leads to an early exit (yes that's only one more pkt->next if the list is correct, but does not hurt).

there is no extra one more pkt->next as the for loop is broken (no for loop next ) when the interface is next

[kfessel]

Suggested change

	for (gnrc_pktsnip_t *ptr = pkt; (ptr && (type == GNRC_NETTYPE_UNDEF));
	ptr = ptr->next) {
	for (gnrc_pktsnip_t *ptr = pkt; ptr; ptr = ptr->next) {