Fix null-deref crash on subscribe/unsubscribe/event to unknown subscription id
subscriptions[id] via operator[] default-constructed (NULL) and inserted an entry for any unregistered id, and the very next line dereferenced it unconditionally - any client referencing a subscription id that was never created (e.g. Zephora client sending subscribe:invite for a channel nobody ever Publish()d) segfaulted the entire process, not just that connection. Use find() and return gracefully instead.
This commit is contained in:
1 parent
cfc0b19418
commit
1e9b5f1016
1 file changed
+18
-1
+18
-1
@@ -101,7 +101,24 @@ namespace core {
|
||||
return 1;
|
||||
}
|
||||
|
||||
auto subscription = subscriptions[request[1].str()];
|
||||
// Was subscriptions[request[1].str()] - map::operator[] default-
|
||||
// constructs (here: NULL) and INSERTS an entry for any id that
|
||||
// isn't already registered, and subscription->id below was then
|
||||
// dereferenced completely unconditionally. Any subscribe:/
|
||||
// unsubscribe:/event: naming an id nobody ever created (confirmed
|
||||
// live: "subscribe:invite", sent by the client on every scene
|
||||
// load, referencing an "invite" subscription that plain doesn't
|
||||
// exist anywhere - real invites are Publish()'d under a
|
||||
// per-group-guid id, not a shared "invite" channel) null-derefs
|
||||
// and takes down the ENTIRE process, every connection included,
|
||||
// not just the one that sent it. find() avoids polluting the map
|
||||
// with the bogus NULL entry too.
|
||||
auto it = subscriptions.find(request[1].str());
|
||||
if (it == subscriptions.end()) {
|
||||
coreutils::Log(coreutils::LOG_DEBUG_1) << "Unknown subscription id: " << request[1].str();
|
||||
return 0;
|
||||
}
|
||||
auto subscription = it->second;
|
||||
|
||||
if (request[1].equals(subscription->id)) {
|
||||
if (request[0] == "unpublish") {
|
||||
|
||||
Reference in new issue
Block a user