From f7d98cbd978b5b1f77fce8e77714de349ca43c18 Mon Sep 17 00:00:00 2001
From: wallycheng <295412260@qq.com>
Date: Fri, 14 Aug 2026 11:22:54 +0800
Subject: [PATCH] libmultipath: check get_word() result in disassemble_map()

  get_word() leaves *word == NULL and returns 0 if its internal
  calloc() fails, which can happen under memory pressure. Every
  other call site in disassemble_map() checks for this case, but the
  path-arguments loop skipped the check before calling atoi(word),
  causing a NULL-pointer dereference on the OOM path.

  Jump to the existing out1 label, which already frees word, to
  match the rest of the function and bail out cleanly.

Signed-off-by: wallycheng <295412260@qq.com>
---
 libmultipath/dmparser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libmultipath/dmparser.c b/libmultipath/dmparser.c
index 83760e30a..df78a1f74 100644
--- a/libmultipath/dmparser.c
+++ b/libmultipath/dmparser.c
@@ -307,6 +307,8 @@ int disassemble_map(const struct vector_s *pathvec,
 			for (k = 0; k < num_paths_args; k++)
 				if (k == 0) {
 					p += get_word(p, &word);
+					if (!word);
+						goto out1;
 					def_minio = atoi(word);
 					free(word);