From 1e9b5f1016d8e690d5dd47b3187c2f50402cb96d Mon Sep 17 00:00:00 2001 From: Matt Arant Date: Mon, 7 Sep 2026 00:48:26 +0000 Subject: [PATCH] Fix null-deref crash on subscribe/unsubscribe/event to unknown subscription id subscriptions[id] via operator[] default-constructed (NULL) and inserted an entry for any unregistered id, and the very next line dereferenced it unconditionally - any client referencing a subscription id that was never created (e.g. Zephora client sending subscribe:invite for a channel nobody ever Publish()d) segfaulted the entire process, not just that connection. Use find() and return gracefully instead. --- SubscriptionManager.cpp | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/SubscriptionManager.cpp b/SubscriptionManager.cpp index 3cb1bfd..a54c873 100644 --- a/SubscriptionManager.cpp +++ b/SubscriptionManager.cpp @@ -101,7 +101,24 @@ namespace core { return 1; } - auto subscription = subscriptions[request[1].str()]; + // Was subscriptions[request[1].str()] - map::operator[] default- + // constructs (here: NULL) and INSERTS an entry for any id that + // isn't already registered, and subscription->id below was then + // dereferenced completely unconditionally. Any subscribe:/ + // unsubscribe:/event: naming an id nobody ever created (confirmed + // live: "subscribe:invite", sent by the client on every scene + // load, referencing an "invite" subscription that plain doesn't + // exist anywhere - real invites are Publish()'d under a + // per-group-guid id, not a shared "invite" channel) null-derefs + // and takes down the ENTIRE process, every connection included, + // not just the one that sent it. find() avoids polluting the map + // with the bogus NULL entry too. + auto it = subscriptions.find(request[1].str()); + if (it == subscriptions.end()) { + coreutils::Log(coreutils::LOG_DEBUG_1) << "Unknown subscription id: " << request[1].str(); + return 0; + } + auto subscription = it->second; if (request[1].equals(subscription->id)) { if (request[0] == "unpublish") {