Skip to content

Conversation

@e2toe8
Copy link

@e2toe8 e2toe8 commented Jun 25, 2025

Describe

I found potential memory safety and stability issues in the Cat codebase:

CWE-476 (NULL Pointer Dereference):

In several parts of the Cat project, such as calls to AlertType.getTypeByName(), an unknown alert type name could cause the method to return null.

If the returned value is used directly without a null check (e.g., calling .getName() or .getTitle()), this could lead to a NullPointerException and result in a crash or undefined behavior.

Expected behavior

  • AlertType.getTypeByName() should always return a valid AlertType instance.
  • If the provided type name is not recognized, the function should return a default value like AlertType.Unknown, not null.
  • All usage sites should be able to call methods on the result safely, without risking a NullPointerException.

Actual behavior

  • Previously, when a non-existent type name was passed, getTypeByName() returned null.
  • If the result was used directly (for example, alert.getType().getName()), a NullPointerException would occur at runtime, potentially causing a crash.

How to Reproduce

  • Pass an unrecognized string to AlertType.getTypeByName("SOME_INVALID_TYPE").
  • The function returns null.
  • Call .getName() or .getTitle() on the returned value without a null check.
  • A NullPointerException occurs at runtime.

Patch

This patch adds an Unknown enum value to AlertType and modifies getTypeByName() to return AlertType.Unknown instead of null when the type name is unrecognized.

This change ensures that a valid enum value is always returned, preventing null pointer dereference vulnerabilities.

Copy link

@mengnankkkk mengnankkkk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good job

Copy link

@Bruce-Qi Bruce-Qi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your change is good and improves code safety and clarity.Just make sure all usages are updated to handle the new Unknown value, and add/update tests as needed.also keep them updated in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants