Skip to content

Fix NULL pointer dereference in ResolveAddress()#251

Closed
hirorogo wants to merge 1 commit into
baidu:masterfrom
hirorogo:fix/null-pointer-dereference-resolve-address
Closed

Fix NULL pointer dereference in ResolveAddress()#251
hirorogo wants to merge 1 commit into
baidu:masterfrom
hirorogo:fix/null-pointer-dereference-resolve-address

Conversation

@hirorogo

@hirorogo hirorogo commented Mar 31, 2026

Copy link
Copy Markdown

Summary

Both overloads of ResolveAddress() in src/sofa/pbrpc/rpc_endpoint.cc accept an RpcEndpoint* endpoint parameter but dereference it unconditionally (*endpoint = it->endpoint()) without checking for NULL. Added NULL validation with error logging, returning false early if endpoint is NULL.

PoC

// Reproduction: ResolveAddress NULL pointer dereference
// When endpoint parameter is NULL, *endpoint = it->endpoint() crashes.
#include <cstdio>
#include <cstring>

struct RpcEndpoint { char host[64]; int port; };

// Simulates the buggy ResolveAddress
bool ResolveAddress_buggy(const char* host, const char* svc, RpcEndpoint* endpoint) {
    // Simulate successful DNS resolution
    RpcEndpoint resolved;
    strncpy(resolved.host, host, 63);
    resolved.port = 8080;

    // BUG: no NULL check
    *endpoint = resolved;  // CRASH when endpoint==NULL
    return true;
}

bool ResolveAddress_fixed(const char* host, const char* svc, RpcEndpoint* endpoint) {
    if (endpoint == NULL) {
        printf("  FIXED: endpoint is NULL, returning false\n");
        return false;
    }
    RpcEndpoint resolved;
    strncpy(resolved.host, host, 63);
    resolved.port = 8080;
    *endpoint = resolved;
    return true;
}

int main() {
    printf("=== FIXED ===\n");
    ResolveAddress_fixed("localhost", "8080", NULL);

    printf("=== BUGGY ===\n");
#ifdef _WIN32
    __try {
        ResolveAddress_buggy("localhost", "8080", NULL);
    } __except(1) {
        printf("  ACCESS VIOLATION: NULL pointer dereference confirmed\n");
    }
#endif
    return 0;
}

Output (MSVC /EHa):

=== FIXED ===
  FIXED: endpoint is NULL, returning false
=== BUGGY ===
  ACCESS VIOLATION: NULL pointer dereference confirmed

Test plan

  • Existing tests still pass
  • Calling ResolveAddress() with NULL endpoint returns false instead of crashing

Both overloads of ResolveAddress() accept an RpcEndpoint* endpoint
parameter but dereference it unconditionally without checking for NULL.
Add NULL validation with error logging before any dereference, returning
false early if endpoint is NULL.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@hirorogo

hirorogo commented Apr 6, 2026

Copy link
Copy Markdown
Author

Closing in favor of #252 which has a cleaner diff. Same fix.

@hirorogo hirorogo closed this Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant