CVE-2020-13848: NULL Pointer Dereference (CWE-476)
value: Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2020-06-04T20:15Z
Repository: https://github.com/pupnp/pupnp
Language: Other
Files changed: ChangeLog, upnp/src/genlib/service_table/service_table.c
Commit date: 2020-06-04 12:03:03 -0300
Commit message: Fixes #177: NULL pointer dereference in FindServiceControlURLPath

Also fixes its dual bug in FindServiceEventURLPath.

Diff: diff --git a/ChangeLog b/ChangeLog
index 4e3d6bf..47a1d4e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,9 +1,15 @@
 *******************************************************************************
 Version 1.12.2
 *******************************************************************************
 
+2020-06-04 Patrik Lantz pjlantz(at)github
+
+        Fixes #177
+
+        NULL pointer dereference in FindServiceControlURLPath
+
 *******************************************************************************
 Version 1.12.1
 *******************************************************************************
 
 2020-04-03 Rene Nielsen <rene.nielsen(at)microchip.com>
diff --git a/upnp/src/genlib/service_table/service_table.c b/upnp/src/genlib/service_table/service_table.c
index 3663fe0..470863e 100644
--- a/upnp/src/genlib/service_table/service_table.c
+++ b/upnp/src/genlib/service_table/service_table.c
@@ -280,13 +280,15 @@ service_info *FindServiceEventURLPath(
 {
 	service_info *finger = NULL;
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table &&
-		parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
-			HTTP_SUCCESS) {
+	if (!table || !eventURLPath) {
+		return NULL;
+	}
+	if (parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->eventURL) {
 				if (parse_uri(finger->eventURL,
 					    strlen(finger->eventURL),
@@ -325,13 +327,15 @@ service_info *FindServiceControlURLPath(
 {
 	service_info *finger = NULL;
 	uri_type parsed_url;
 	uri_type parsed_url_in;
 
-	if (table && parse_uri(controlURLPath,
-			     strlen(controlURLPath),
-			     &parsed_url_in) == HTTP_SUCCESS) {
+	if (!table || !controlURLPath) {
+		return NULL;
+	}
+	if (parse_uri(controlURLPath, strlen(controlURLPath), &parsed_url_in) ==
+		HTTP_SUCCESS) {
 		finger = table->serviceList;
 		while (finger) {
 			if (finger->controlURL) {
 				if (parse_uri(finger->controlURL,
 					    strlen(finger->controlURL),

Vulnerable code: 	if (table &&
		parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
			HTTP_SUCCESS) {
	if (table && parse_uri(controlURLPath,
			     strlen(controlURLPath),
			     &parsed_url_in) == HTTP_SUCCESS) {
Fixed code: 2020-06-04 Patrik Lantz pjlantz(at)github

        Fixes #177

        NULL pointer dereference in FindServiceControlURLPath

	if (!table || !eventURLPath) {
		return NULL;
	}
	if (parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
		HTTP_SUCCESS) {
	if (!table || !controlURLPath) {
		return NULL;
	}
	if (parse_uri(controlURLPath, strlen(controlURLPath), &parsed_url_in) ==
		HTTP_SUCCESS) {