Re: [PATCH 1/4] libkeymap: prevent NULL dereference in parser

[Alexey Gladkov <legion@kernel.org>]

On Sat, Feb 14, 2026 at 08:27:30PM +0300, Krdyan Areg wrote:
> The parser accesses ctx->key_line array elements without checking if
> lk_array_get() returns NULL, which can lead to crashes.
> 
> Add NULL checks before dereferencing array values.
> 
> Signed-off-by: Krdyan Areg areg.krdian@gmail.com
> ---
>  src/libkeymap/parser.y | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/src/libkeymap/parser.y b/src/libkeymap/parser.y
> index 2cd509f..a87fb54 100644
> --- a/src/libkeymap/parser.y
> +++ b/src/libkeymap/parser.y
> @@ -320,6 +320,9 @@ singleline	: KEYCODE NUMBER EQUALS rvalue0 EOL
>  
>  							if (i < ctx->key_line->count) {
>  								val = lk_array_get(ctx->key_line, i);
> +								if (!val)
> +									YYERROR;
> +

I do not think this change is needed right now. In these parser paths,
lk_array_get() is used with indices bounded by ctx->key_line->count, and
count is built only through lk_array_append().

I already fixed in master the real failure by checking lk_array_append()
and aborting on OOM.

So this patch mostly adds defensive checks for an internal-corruption
scenario, rather than fixing a practical bug in normal execution.

>  								keycode = *val;
>  							}
>  
> @@ -338,7 +341,7 @@ singleline	: KEYCODE NUMBER EQUALS rvalue0 EOL
>  					for (i = 0; i < ctx->key_line->count; i++) {
>  						val = lk_array_get(ctx->key_line, i);
>  
> -						if (lk_add_key(ctx, i, $2, *val) < 0)
> +						if (!val || lk_add_key(ctx, i, $2, *val) < 0)
>  							YYERROR;
>  					}
>  				}
> -- 
> 2.52.0
> 

-- 
Rgrds, legion