Fix null-deref crash on subscribe/unsubscribe/event to unknown subscription id

subscriptions[id] via operator[] default-constructed (NULL) and
inserted an entry for any unregistered id, and the very next line
dereferenced it unconditionally - any client referencing a
subscription id that was never created (e.g. Zephora client sending
subscribe:invite for a channel nobody ever Publish()d) segfaulted the
entire process, not just that connection. Use find() and return
gracefully instead.
This commit is contained in:
Matt Arant committed 2026-09-07 00:48:26 +00:00
1 parent cfc0b19418
commit 1e9b5f1016
1 file changed
+18 -1
+18 -1
View File
@@ -101,7 +101,24 @@ namespace core {
return 1; return 1;
} }
auto subscription = subscriptions[request[1].str()]; // Was subscriptions[request[1].str()] - map::operator[] default-
// constructs (here: NULL) and INSERTS an entry for any id that
// isn't already registered, and subscription->id below was then
// dereferenced completely unconditionally. Any subscribe:/
// unsubscribe:/event: naming an id nobody ever created (confirmed
// live: "subscribe:invite", sent by the client on every scene
// load, referencing an "invite" subscription that plain doesn't
// exist anywhere - real invites are Publish()'d under a
// per-group-guid id, not a shared "invite" channel) null-derefs
// and takes down the ENTIRE process, every connection included,
// not just the one that sent it. find() avoids polluting the map
// with the bogus NULL entry too.
auto it = subscriptions.find(request[1].str());
if (it == subscriptions.end()) {
coreutils::Log(coreutils::LOG_DEBUG_1) << "Unknown subscription id: " << request[1].str();
return 0;
}
auto subscription = it->second;
if (request[1].equals(subscription->id)) { if (request[1].equals(subscription->id)) {
if (request[0] == "unpublish") { if (request[0] == "unpublish") {