From 5d4fffbb146eb21635d9862df070021241699af2 Mon Sep 17 00:00:00 2001 From: eunho87 Date: Tue, 15 Sep 2026 10:50:14 +0900 Subject: [PATCH] Guard against NULL return in mg_file_printf mg_vmprintf() returns io.buf from a mg_iobuf that starts empty. When the internal mg_iobuf_resize() allocation fails, the buffer is left NULL and mg_vmprintf() returns NULL. mg_file_printf() passed that result straight to strlen(data), dereferencing NULL on allocation failure. Skip the write when mg_vmprintf() returns NULL and return false, matching how the rest of the codebase checks mg_calloc()/allocation results. --- mongoose.c | 6 ++++-- src/fs.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/mongoose.c b/mongoose.c index a22898a3..f164b5e7 100644 --- a/mongoose.c +++ b/mongoose.c @@ -3046,8 +3046,10 @@ bool mg_file_printf(struct mg_fs *fs, const char *path, const char *fmt, ...) { va_start(ap, fmt); data = mg_vmprintf(fmt, &ap); va_end(ap); - result = mg_file_write(fs, path, data, strlen(data)); - mg_free(data); + if (data != NULL) { + result = mg_file_write(fs, path, data, strlen(data)); + mg_free(data); + } return result; } diff --git a/src/fs.c b/src/fs.c index fd9d7e6b..6df00c4a 100644 --- a/src/fs.c +++ b/src/fs.c @@ -67,8 +67,10 @@ bool mg_file_printf(struct mg_fs *fs, const char *path, const char *fmt, ...) { va_start(ap, fmt); data = mg_vmprintf(fmt, &ap); va_end(ap); - result = mg_file_write(fs, path, data, strlen(data)); - mg_free(data); + if (data != NULL) { + result = mg_file_write(fs, path, data, strlen(data)); + mg_free(data); + } return result; }