Browse Source

fix: Zero pointer access on invalid node

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17099
Credit to oss-fuzz
Stefan Profanter 4 years ago
parent
commit
aefbc589ee
1 changed files with 2 additions and 1 deletions
  1. 2 1
      src/server/ua_subscription_events.c

+ 2 - 1
src/server/ua_subscription_events.c

@@ -13,7 +13,8 @@
 UA_StatusCode
 UA_MonitoredItem_removeNodeEventCallback(UA_Server *server, UA_Session *session,
                                          UA_Node *node, void *data) {
-    UA_assert(node->nodeClass == UA_NODECLASS_OBJECT);
+    if (node->nodeClass != UA_NODECLASS_OBJECT)
+        return UA_STATUSCODE_BADINVALIDARGUMENT;
     UA_ObjectNode *on = (UA_ObjectNode*)node;
     UA_MonitoredItem *remove = (UA_MonitoredItem*)data;