Fixes #177: NULL pointer dereference in FindServiceControlURLPath

Also fixes its dual bug in FindServiceEventURLPath.
pupnp · Jun 4, 2020 · c805c1d · c805c1d
1 parent ef04e55
commit c805c1d
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 6 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -2,6 +2,12 @@
 Version 1.12.2
 *******************************************************************************
 
+2020-06-04 Patrik Lantz pjlantz(at)github
+
+        Fixes #177
+
+        NULL pointer dereference in FindServiceControlURLPath
+
 *******************************************************************************
 Version 1.12.1
 *******************************************************************************

diff --git a/upnp/src/genlib/service_table/service_table.c b/upnp/src/genlib/service_table/service_table.c
@@ -282,9 +282,11 @@ service_info *FindServiceEventURLPath(
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table &&
-		parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
-			HTTP_SUCCESS) {
+	if (!table || !eventURLPath) {
+		return NULL;
+	}
+	if (parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->eventURL) {
@@ -327,9 +329,11 @@ service_info *FindServiceControlURLPath(
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table && parse_uri(controlURLPath,
-			     strlen(controlURLPath),
-			     &parsed_url_in) == HTTP_SUCCESS) {
+	if (!table || !controlURLPath) {
+		return NULL;
+	}
+	if (parse_uri(controlURLPath, strlen(controlURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->controlURL) {