-
Notifications
You must be signed in to change notification settings - Fork 693
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Null pointer dereference in ImportBlackboardFromJSON when entry creation fails #921
Comments
Thanks for the accurate description. The more interesting question here is why "blackboard.createEntry(it.key(), res->second);" is not doing what is expected to do. Do you have perhaps a simple example to reproduce the issue? |
I must have a reproducer lying around that I used when debugging this. I’ll try to attach one ASAP. While I’m at it, I’ll try to deliver a minimal PoC for all the other ones as well! |
Okay, after some debugging I came to the conclusion that unlike stated above in the original description suggested this was a simple null pointer dereference from Minimal Reproducer#include "behaviortree_cpp/blackboard.h"
#include <iostream>
#include <nlohmann/json.hpp>
int main() {
try {
auto bb = BT::Blackboard::create();
// Set initial value
bb->set("mmmmmm5CnCaaG", -535822226);
// Create JSON that will trigger the crash
std::string json_str = R"({
"@@@@@@@@@@@@@@@": -535822226,
"mmmmmm5CnCaaG": null
})";
// Parse and import JSON - will crash
auto json = nlohmann::json::parse(json_str);
BT::ImportBlackboardFromJSON(json, *bb);
}
catch(const std::exception& e) {
std::cerr << "Exception: " << e.what() << std::endl;
return 1;
}
return 0;
} Updated stack-trace
The issue appears to be related to type handling in the Any implementation when dealing with null values during JSON deserialization. This suggests the fix might need to handle:
|
#include "behaviortree_cpp/blackboard.h"
#include <iostream>
#include <nlohmann/json.hpp>
int main() {
try {
auto bb = BT::Blackboard::create();
// Set initial value
bb->set("mmmmmm5CnCaaG", -535822226);
// Create JSON that will trigger the crash
std::string json_str = R"({
"@@@@@@@@@@@@@@@": -535822226,
"mmmmmm5CnCaaG": null
})";
// Parse and import JSON - will crash
auto json = nlohmann::json::parse(json_str);
BT::ImportBlackboardFromJSON(json, *bb);
}
catch(const std::exception& e) {
std::cerr << "Exception: " << e.what() << std::endl;
return 1;
}
return 0;
} Hi, @facontidavide The reason why I've submitted a PR to fix this behavior #929 |
fixed making that syntax illegal, as it should be |
Description
A null pointer dereference occurs in
ImportBlackboardFromJSON
when attempting to use anentry
pointer without verifying that the entry was successfully created. This happens because the code assumescreateEntry
followed bygetEntry
will always return a validentry
.BehaviorTree.CPP/src/blackboard.cpp
Lines 280 to 295 in 48f6c5b
Found in commit: 48f6c5b
Bug Class
Memory Safety - Null Pointer Dereference
Root Cause
The issue occurs because:
getEntry
returnsnullptr
entry
if it doesn't existentry
again but doesn't verify it's validentry
pointer without checkingGDB
Stack trace
Proposed Fix
Impact
Impact
The text was updated successfully, but these errors were encountered: