sofa-pbrpc
sofa-pbrpc copied to clipboard
Fix a null pointer dereference bug in function parse_msg
Explanation of the bug
The function parse_msg may return a null value.
static rapidjson::Value* parse_msg(const Message *msg, rapidjson::Value::AllocatorType& allocator)
{
const Descriptor *d = msg->GetDescriptor();
if (!d)
return NULL;
size_t count = d->field_count();
rapidjson::Value* root = new rapidjson::Value(rapidjson::kObjectType);
if (!root)
return NULL;
...
In function field2json, the return value from parse_msg at line 214 is assigned to the pointer json and returned to the caller at line 235.
else
{
const Message *value = &(ref->GetMessage(*msg, field));
json = parse_msg(value, allocator); // propagate to the pointer json
}
break;
default:
break;
}
return json; // return to caller function
Then, in function parse_msg, the return value from field2json at line 269 is assigned to field_json and dereferenced without null check at line 270, causing a null pointer dereference bug.
rapidjson::Value* field_json = field2json(msg, field, allocator);
root->AddMember(name, *field_json, allocator); // NPD here
delete field_json;
Fix
I add a null check after calling the function field2json.