[PATCH] networking: ntpd.c: fix NULL pointer dereference in recv_and_process_client_pkt

Static analysis (SAST) reported a potential NULL pointer dereference:

  ntpd.c:2088: from = xzalloc(to->len);
  Warning: Pointer returned from get_sock_lsa() may be NULL and is
  dereferenced at ntpd.c:2088.

The function get_sock_lsa() (libbb/xconnect.c) does not have the 'x'
prefix, meaning it can return NULL on error (e.g., if getsockname()
fails due to invalid socket, resource exhaustion, or container
restrictions). The code did not check the return value before
accessing to->len, which could lead to a crash.

Fix: add explicit NULL check after get_sock_lsa() call.
If to is NULL, report error and terminate (consistent with other
fatal error handling in ntpd server path).

Signed-off-by: Anton Moryakov <[email protected]>
---
 networking/ntpd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/networking/ntpd.c b/networking/ntpd.c
index 595000b11..989f7171e 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -2086,6 +2086,8 @@ recv_and_process_client_pkt(void /*int fd*/)
 	l_fixedpt_t      query_xmttime;
 
 	to = get_sock_lsa(G_listen_fd);
+	if (!to)
+    	bb_simple_perror_msg_and_die("get_sock_lsa");
 	from = xzalloc(to->len);
 
 	size = recv_from_to(G_listen_fd, &msg, sizeof(msg), MSG_DONTWAIT, from, &to->u.sa, to->len);
-- 
2.39.2