NULL pointer dereference in handleFaupCommand via malformed input

[zagers]

Security Vulnerability: NULL Pointer Dereference (Medium)

Description

In handleFaupCommand, strtok(NULL, "\t") can return NULL when a client sends a field name without a corresponding value. The NULL pointer is then passed to atof(), which is undefined behavior and typically causes a segfault/crash.

Location

net_io.c:1138-1175

Vulnerable Code

msg_field = strtok(p, "\t");
while (msg_field != NULL) {
    if (!strcmp(msg_field, "upload_rate_multiplier")) {
        msg_field = strtok(NULL, "\t");
        multiplier = atof(msg_field);  // msg_field could be NULL!

Attack Vector

A client connected to the FAUP command port sends:

upload_rate_multiplier\t

(with a tab but no value). strtok returns NULL, atof(NULL) crashes.

Same issue exists for upload_unknown_commb at line 1166.

Impact

• Denial of service via crash
• Any connected client can trigger this

Suggested Fix

Check msg_field != NULL after each strtok(NULL, ...) call:

msg_field = strtok(NULL, "\t");
if (msg_field == NULL)
    break;
multiplier = atof(msg_field);

[mutability]

This code only runs in faup1090, which is invoked by piaware; the commands it receives are from piaware itself, and piaware isn't going to send malformed commands (intentionally, anyway!)

So you can really only crash a faup1090 that you started yourself, and nobody's expected to start a faup1090 directly anyway, so this isn't really a security problem at all. You certainly cannot even get this code to execute on a regular dump1090, so "any connected client" is wild hyperbole.

(checking for malformed messages isn't a terrible idea though)