From 1220ba8a47c0a33515bca7803f2ff8da652a6e4f Mon Sep 17 00:00:00 2001 From: fengzero Date: Wed, 1 Jul 2026 08:28:38 +0000 Subject: [PATCH] fix null point --- plugins/mqtt/mqtt_handle.c | 5 +++ src/parser/neu_json_global_config.c | 14 +++++++-- src/utils/cid.c | 4 +++ src/utils/json.c | 48 +++++++++++++++++++++++++++++ 4 files changed, 69 insertions(+), 2 deletions(-) diff --git a/plugins/mqtt/mqtt_handle.c b/plugins/mqtt/mqtt_handle.c index 45b7cc66d..eab8a9d5e 100644 --- a/plugins/mqtt/mqtt_handle.c +++ b/plugins/mqtt/mqtt_handle.c @@ -582,6 +582,11 @@ void handle_write_req(neu_mqtt_qos_e qos, const char *topic, } for (size_t i = 0; i < wr->n_tags; i++) { + if (wr->tags[i]->name == NULL || wr->tags[i]->value == NULL) { + plog_error(plugin, "write request tag missing name/value"); + model__write_request__free_unpacked(wr, NULL); + return; + } if (strlen(wr->tags[i]->name) >= NEU_TAG_NAME_LEN) { plog_error(plugin, "tag name too long"); model__write_request__free_unpacked(wr, NULL); diff --git a/src/parser/neu_json_global_config.c b/src/parser/neu_json_global_config.c index 402dcc6da..968007435 100644 --- a/src/parser/neu_json_global_config.c +++ b/src/parser/neu_json_global_config.c @@ -239,7 +239,12 @@ int neu_json_decode_global_config_req_subscriptions( json_t *grp_array = json_object_get(sub_obj, "groups"); for (size_t j = 0; j < json_array_size(grp_array); ++j) { - p->app = strdup(json_string_value(app_obj)); + const char *app_str = json_string_value(app_obj); + if (NULL == app_str) { + nlog_error("`app` field is not a string"); + goto error; + } + p->app = strdup(app_str); if (NULL == p->app) { nlog_error("strdup fail"); goto error; @@ -318,7 +323,12 @@ int neu_json_decode_global_config_req_settings( goto error; } - p->node = strdup(json_string_value(node_obj)); + const char *node_str = json_string_value(node_obj); + if (NULL == node_str) { + nlog_error("`node` field is not a string"); + goto error; + } + p->node = strdup(node_str); if (NULL == p->node) { nlog_error("strdup fail"); goto error; diff --git a/src/utils/cid.c b/src/utils/cid.c index 68c2828f9..b0663f0c2 100644 --- a/src/utils/cid.c +++ b/src/utils/cid.c @@ -531,6 +531,10 @@ static int parse_ied(xmlNode *xml_ied, cid_ied_t *ied) { int ret = -1; char *ied_name = (char *) xmlGetProp(xml_ied, (const xmlChar *) "name"); + if (ied_name == NULL) { + nlog_warn("IED has no name attribute"); + return -1; + } if (strlen(ied_name) >= NEU_CID_IED_NAME_LEN) { xmlFree(ied_name); nlog_warn("IED name is too long"); diff --git a/src/utils/json.c b/src/utils/json.c index ed629b67c..45fa803ae 100644 --- a/src/utils/json.c +++ b/src/utils/json.c @@ -594,6 +594,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_str.length > 0) { ele->v.val_array_str.p_strs = calloc(ele->v.val_array_str.length, sizeof(char *)); + if (NULL == ele->v.val_array_str.p_strs) { + ele->v.val_array_str.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_str.length; i++) { json_t * value = json_array_get(ob, i); const char *str_val = json_string_value(value); @@ -610,6 +614,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_bool.length > 0) { ele->v.val_array_bool.bools = calloc(ele->v.val_array_bool.length, sizeof(bool)); + if (NULL == ele->v.val_array_bool.bools) { + ele->v.val_array_bool.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_bool.length; i++) { json_t *value = json_array_get(ob, i); ele->v.val_array_bool.bools[i] = json_boolean_value(value); @@ -622,6 +630,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_uint8.length > 0) { ele->v.val_array_uint8.u8s = calloc(ele->v.val_array_uint8.length, sizeof(int8_t)); + if (NULL == ele->v.val_array_uint8.u8s) { + ele->v.val_array_uint8.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_uint8.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -639,6 +651,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_int8.length > 0) { ele->v.val_array_int8.i8s = calloc(ele->v.val_array_int8.length, sizeof(int8_t)); + if (NULL == ele->v.val_array_int8.i8s) { + ele->v.val_array_int8.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_int8.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -656,6 +672,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_uint16.length > 0) { ele->v.val_array_uint16.u16s = calloc(ele->v.val_array_uint16.length, sizeof(int16_t)); + if (NULL == ele->v.val_array_uint16.u16s) { + ele->v.val_array_uint16.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_uint16.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -673,6 +693,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_int16.length > 0) { ele->v.val_array_int16.i16s = calloc(ele->v.val_array_int16.length, sizeof(int16_t)); + if (NULL == ele->v.val_array_int16.i16s) { + ele->v.val_array_int16.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_int16.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -690,6 +714,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_uint32.length > 0) { ele->v.val_array_uint32.u32s = calloc(ele->v.val_array_uint32.length, sizeof(int32_t)); + if (NULL == ele->v.val_array_uint32.u32s) { + ele->v.val_array_uint32.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_uint32.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -707,6 +735,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_int32.length > 0) { ele->v.val_array_int32.i32s = calloc(ele->v.val_array_int32.length, sizeof(int32_t)); + if (NULL == ele->v.val_array_int32.i32s) { + ele->v.val_array_int32.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_int32.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -724,6 +756,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_uint64.length > 0) { ele->v.val_array_uint64.u64s = calloc(ele->v.val_array_uint64.length, sizeof(int64_t)); + if (NULL == ele->v.val_array_uint64.u64s) { + ele->v.val_array_uint64.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_uint64.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -741,6 +777,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_int64.length > 0) { ele->v.val_array_int64.i64s = calloc(ele->v.val_array_int64.length, sizeof(int64_t)); + if (NULL == ele->v.val_array_int64.i64s) { + ele->v.val_array_int64.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_int64.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_real(value)) { @@ -758,6 +798,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_float.length > 0) { ele->v.val_array_float.f32s = calloc(ele->v.val_array_float.length, sizeof(float)); + if (NULL == ele->v.val_array_float.f32s) { + ele->v.val_array_float.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_float.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_integer(value)) { @@ -775,6 +819,10 @@ static int decode_object(json_t *root, neu_json_elem_t *ele) if (ele->v.val_array_double.length > 0) { ele->v.val_array_double.f64s = calloc(ele->v.val_array_double.length, sizeof(double)); + if (NULL == ele->v.val_array_double.f64s) { + ele->v.val_array_double.length = 0; + break; + } for (int i = 0; i < ele->v.val_array_double.length; i++) { json_t *value = json_array_get(ob, i); if (json_is_integer(value)) {