Skip to content

cachedb_memcached, cachedb_cassandra: fix NULL deref in connection init#3849

Open
dondetir wants to merge 2 commits intoOpenSIPS:masterfrom
dondetir:fix/cachedb-null-deref-audit
Open

cachedb_memcached, cachedb_cassandra: fix NULL deref in connection init#3849
dondetir wants to merge 2 commits intoOpenSIPS:masterfrom
dondetir:fix/cachedb-null-deref-audit

Conversation

@dondetir
Copy link
Copy Markdown

Summary

Fix NULL pointer dereferences in cachedb_memcached and cachedb_cassandra connection initialization, following the same pattern fixed in cachedb_redis (8fb569c).

Details

  • Type: Bug fix
  • Motivation: Commit 8fb569c fixed a NULL dereference in cachedb_redis where redisConnect() could return NULL on allocation failure but the return was used without a NULL check. A systematic audit of all other cachedb backends revealed the same pattern in two more modules:
  1. cachedb_memcachedmemcached_create(NULL) can return NULL on allocation failure (documented behavior). No NULL check exists before passing the pointer to memcached_server_push(), causing a crash.

  2. cachedb_cassandracass_cluster_new() can return NULL on allocation failure. A NULL check exists, but it comes after cass_cluster_set_credentials() already dereferences the pointer (when credentials are configured), so the check is too late.

  • Affected scenarios: Both bugs trigger on memory allocation failure during connection initialization. While OOM during init is rare, the redis fix addressed the identical case and was merged.
  • Generic problem — not specific to any particular UAC or scenario.

Solution

  • memcached: Added NULL check immediately after memcached_create(), following the existing error pattern in the function (pkg_free(con); return 0).
  • cassandra: Moved the existing NULL check to immediately after cass_cluster_new(), before any use of the pointer. No new code — just reordered.
  • Remaining concerns: None. Both fixes are minimal and follow established patterns.

Compatibility

  • No backward compatibility issues
  • No migration needed
  • No SIP interoperability impact
  • These are purely defensive NULL checks on error paths that previously would crash

Closing Issues

N/A — no open issue for these. Found via code audit following 8fb569c.

memcached_create(NULL) can return NULL on allocation failure.  The existing
code never checks the return value, so a NULL memc pointer falls through to
memcached_server_push(NULL, ...) which dereferences the NULL pointer.

Add an explicit NULL check after memcached_create(), following the existing
error-handling pattern in the function (pkg_free + return 0).

Found during a systematic audit of cachedb backends following the
cachedb_redis NULL-deref fix in commit 8fb569c.
cass_cluster_new() can return NULL on allocation failure.  The existing code
has a NULL check, but it comes after cass_cluster_set_credentials() already
uses the pointer (when credentials are configured), so a NULL return causes
a crash before the check is reached.

Move the NULL check to immediately after cass_cluster_new(), before any use
of the returned pointer.

Found during a systematic audit of cachedb backends following the
cachedb_redis NULL-deref fix in commit 8fb569c.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant