From 87adae916d94fecb40e2d72ea443efbb2bce7424 Mon Sep 17 00:00:00 2001
From: Wahaj18 <48466561+Wahaj18@users.noreply.github.com>
Date: Wed, 21 Oct 2026 12:39:51 +0500
Subject: [PATCH] Fix out-of-bounds read and NULL dereference when loading
 transponder JSON

The modes and transmitter JSON files were read into a buffer of exactly
the file size with no terminating NUL. nx_json_parse() takes no length,
so a truncated download could make it read, and in some cases write,
past the end of the buffer. Allocate one extra zeroed byte.

nx_json_get() returns a node with a NULL text_value when a key is
missing, which was passed straight to strncpy(). Skip mode entries
without a name and transmitter entries without a description.

Fixes #434
---
 src/trsp-update.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/trsp-update.c b/src/trsp-update.c
index fae96e01..da8edb5d 100644
--- a/src/trsp-update.c
+++ b/src/trsp-update.c
@@ -184,7 +184,7 @@ void trsp_update_files(gchar * input_file)
         {
             mfplen = flen;
             rewind(mfp);
-            jsn_object = g_malloc(mfplen);
+            jsn_object = g_malloc0(mfplen + 1);
             result = fread(jsn_object, mfplen, 1, mfp);
 
             if (result == 1)
@@ -202,9 +202,14 @@ void trsp_update_files(gchar * input_file)
                         if (json_obj->type == NX_JSON_NULL)
                             break;
 
+                        const char     *name =
+                            nx_json_get(json_obj, "name")->text_value;
+
+                        if (name == NULL)
+                            continue;
+
                         m_modes.id = nx_json_get(json_obj, "id")->int_value;
-                        strncpy(m_modes.name,
-                                nx_json_get(json_obj, "name")->text_value, 79);
+                        strncpy(m_modes.name, name, 79);
                         m_modes.name[79] = 0;
 
                         /* add data to hash table */
@@ -250,7 +255,7 @@ void trsp_update_files(gchar * input_file)
         {
             mfplen = flen;
             rewind(mfp);
-            jsn_object = g_malloc(mfplen);
+            jsn_object = g_malloc0(mfplen + 1);
             result = fread(jsn_object, mfplen, 1, mfp);
 
             if (result == 1)
@@ -268,9 +273,13 @@ void trsp_update_files(gchar * input_file)
                         if (json_obj->type == NX_JSON_NULL)
                             break;
 
-                        strncpy(m_trsp.description,
-                                nx_json_get(json_obj,
-                                            "description")->text_value, 79);
+                        const char     *description =
+                            nx_json_get(json_obj, "description")->text_value;
+
+                        if (description == NULL)
+                            continue;
+
+                        strncpy(m_trsp.description, description, 79);
                         m_trsp.description[79] = 0;
                         m_trsp.catnum =
                             nx_json_get(json_obj, "norad_cat_id")->int_value;