From a9500867912da356629946f6f6fd5e96d06aaae2 Mon Sep 17 00:00:00 2001 From: Cherrling Date: Tue, 9 Jun 2026 23:21:19 +0800 Subject: [PATCH] fix: guard NULL dereference in parse_window_size on invalid JSON When json_tokener_parse_ex fails (invalid JSON), it returns NULL. The old code passed this NULL directly to json_object_object_get_ex, causing undefined behavior / crash on older json-c versions. Also guard the JSON_DATA call site where obj is used for AuthToken lookup without a NULL check. Fixes: NULL pointer dereference via RESIZE_TERMINAL or JSON_DATA with malformed JSON payload (no auth required for RESIZE_TERMINAL). --- src/protocol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/protocol.c b/src/protocol.c index adb7d63dc..139917ae1 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -39,12 +39,14 @@ static int send_initial_message(struct lws *wsi, int index) { static json_object *parse_window_size(const char *buf, size_t len, uint16_t *cols, uint16_t *rows) { json_tokener *tok = json_tokener_new(); json_object *obj = json_tokener_parse_ex(tok, buf, len); - struct json_object *o = NULL; + json_tokener_free(tok); + + if (obj == NULL) return NULL; + struct json_object *o = NULL; if (json_object_object_get_ex(obj, "columns", &o)) *cols = (uint16_t)json_object_get_int(o); if (json_object_object_get_ex(obj, "rows", &o)) *rows = (uint16_t)json_object_get_int(o); - json_tokener_free(tok); return obj; } @@ -334,6 +336,7 @@ int callback_tty(struct lws *wsi, enum lws_callback_reasons reason, void *user, uint16_t columns = 0; uint16_t rows = 0; json_object *obj = parse_window_size(pss->buffer, pss->len, &columns, &rows); + if (obj == NULL) break; if (server->credential != NULL) { struct json_object *o = NULL; if (json_object_object_get_ex(obj, "AuthToken", &o)) {