Skip to content

[mod_lua] Guard JSON::execute2() against NULL cJSON output - #3127

Open
fsliwenjie wants to merge 1 commit into
signalwire:masterfrom
fsliwenjie:fix-mod-lua-json-execute2-null
Open

[mod_lua] Guard JSON::execute2() against NULL cJSON output#3127
fsliwenjie wants to merge 1 commit into
signalwire:masterfrom
fsliwenjie:fix-mod-lua-json-execute2-null

Conversation

@fsliwenjie

Copy link
Copy Markdown

mod_lua's JSON::execute2() crashes the whole FreeSWITCH process with SIGSEGV whenever the underlying switch_json_api_execute() call returns no reply.

Root cause

src/mod/languages/mod_lua/freeswitch_lua.cpp (JSON::execute2, both the const char * and SWIGLUA_TABLE overloads):

cpp cJSON *reply = execute(str); char *s = _return_unformatted_json ? cJSON_PrintUnformatted(reply) : cJSON_Print(reply); std::string result = std::string(s); /* <-- std::string(NULL) -> SIGSEGV */

When the JSON API command fails / does not exist, switch_json_api_execute() leaves
eply == NULL. cJSON_Print(NULL) / cJSON_PrintUnformatted(NULL) then return NULL, and passing NULL to the std::string constructor is undefined behavior - on Linux it dereferences NULL and raises SIGSEGV, taking down every active call.

Fix

Null-check the pointer before constructing the std::string in both overloads:

cpp std::string result = std::string(s ? s : "");

ree(NULL) and cJSON_Delete(NULL) are already safe no-ops, so the only unsafe spot was the std::string construction. A failed API call now yields an empty string instead of crashing the process.

Testing

  • Reproduced on master: luarun invoking reeswitch.JSON():execute('{ "command": "no_such_command" }') segfaults mod_lua.
  • With the fix, the same call returns an empty string and the process stays up.
  • Builds cleanly; no behavioral change for the success path.

Resolves: #3124

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

mod_lua: JSON::execute2() segfaults when JSON API returns no reply — std::string(NULL)

1 participant