devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 8 Actions Packages Projects 1 Releases Wiki Activity

fix(xmpp): treat disco#info result without 'from' as from the server #170

Manually merged
jabber.developer2 merged 1 commits from fix/disco-info-null-from into master 2026-07-29 19:39:56 +00:00
Conversation 1 Commits 1 Files Changed 5 +51 -3
jabber.developer2 commented 2026-07-21 06:20:13 +00:00
Collaborator
Copy Link

Fixes #168

RFC 6120 §8.1.2.1: a stanza received over a c2s stream without a from attribute must be treated as coming from the server itself. The on-connect disco#info handler passed the absent attribute as NULL into connection_features_received(), where g_str_hash() dereferenced the NULL key and crashed — a remotely triggerable DoS on connect.

Substitute connection_get_domain() for a missing from in both disco#info response handlers (src/xmpp/iq.c).
Defense in depth: make connection_features_received() and connection_get_features() NULL-safe (src/xmpp/connection.c).
Regression test: disco_info_result_no_from answers the on-connect disco#info with a from-less result via stabber; before the fix this crashed the client during login.

Fixes #168 RFC 6120 §8.1.2.1: a stanza received over a c2s stream without a from attribute must be treated as coming from the server itself. The on-connect disco#info handler passed the absent attribute as NULL into connection_features_received(), where g_str_hash() dereferenced the NULL key and crashed — a remotely triggerable DoS on connect. Substitute connection_get_domain() for a missing from in both disco#info response handlers (src/xmpp/iq.c). Defense in depth: make connection_features_received() and connection_get_features() NULL-safe (src/xmpp/connection.c). Regression test: disco_info_result_no_from answers the on-connect disco#info with a from-less result via stabber; before the fix this crashed the client during login.
jabber.developer2 added 1 commit 2026-07-21 06:20:13 +00:00
fix(xmpp): treat disco#info result without 'from' as from the server
All checks were successful
CI Code / Check spelling (pull_request) Successful in 14s
Details
CI Code / Check coding style (pull_request) Successful in 24s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 8m29s
Details
CI Code / Linux (debian) (pull_request) Successful in 8m53s
Details
CI Code / Code Coverage (pull_request) Successful in 9m7s
Details
CI Code / Linux (arch) (pull_request) Successful in 12m11s
Details
a283c4e7b4 
RFC 6120 §8.1.2.1: a stanza received over a c2s stream without a 'from'
attribute must be treated as coming from the server itself. The
on-connect disco#info handler passed the absent attribute as NULL into
connection_features_received(), where g_str_hash() dereferenced the NULL
key and crashed (remotely triggerable DoS on connect).

Substitute connection_get_domain() at both disco#info handler
boundaries, and make connection_features_received() and
connection_get_features() NULL-safe as defense in depth. Add a stabber
regression test answering the on-connect disco#info with a from-less
result.

Fixes #168
jabber.developer force-pushed fix/disco-info-null-from from a283c4e7b4 to c9455d27ba 2026-07-26 11:50:02 +00:00 Compare
jabber.developer force-pushed fix/disco-info-null-from from c9455d27ba to 2c8bd867b9 2026-07-27 13:01:26 +00:00 Compare
jabber.developer approved these changes 2026-07-28 17:31:10 +00:00
jabber.developer left a comment
Owner
Copy Link

LGTM

LGTM
jabber.developer2 added 1 commit 2026-07-28 19:03:25 +00:00
fix(xmpp): log resolved key instead of possibly-NULL jid
All checks were successful
CI Code / Check spelling (pull_request) Successful in 16s
Details
CI Code / Check coding style (pull_request) Successful in 1m9s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 4m46s
Details
CI Code / Linux (debian) (pull_request) Successful in 9m6s
Details
CI Code / Code Coverage (pull_request) Successful in 9m50s
Details
CI Code / Linux (arch) (pull_request) Successful in 13m16s
Details
f2918f5aaf
jabber.developer2 force-pushed fix/disco-info-null-from from f2918f5aaf to d914e42ff6 2026-07-28 19:12:58 +00:00 Compare
jabber.developer2 manually merged commit d914e42ff6 into master 2026-07-29 19:39:56 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
jabber.developer
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
Kind/Bug
Something is not working
Kind/Documentation
Documentation changes
Kind/Enhancement
Improve existing functionality
Kind/Feature
New functionality
Kind/Security
This is security issue
Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
admin jabber.developer jabber.developer2
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: devs/cproof#170
No description provided.
Delete Branch "fix/disco-info-null-from"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?