fix(userspace/libsinsp): avoid dereferencing a possible nullptr in pa…

…rsers Signed-off-by: Federico Di Pierro <[email protected]>
falcosecurity · Sep 25, 2024 · 227233b · 227233b
1 parent d4efc80
commit 227233b
Showing 1 changed file with 14 additions and 10 deletions.
diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -422,20 +422,24 @@ void sinsp_parser::process_event(sinsp_evt *evt) {
 	case PPME_SYSCALL_MKDIRAT_X:
 	case PPME_SYSCALL_UNLINKAT_2_X:
 	case PPME_SYSCALL_MKNODAT_X: {
-		auto res = evt->get_param(0)->as<int64_t>();
-		if(res >= 0) {
-			// Only if successful
-			auto dirfd = evt->get_param(1)->as<int64_t>();
-			evt->set_fd_info(evt->get_tinfo()->get_fd(dirfd));
+		if (evt->get_tinfo() != nullptr) {
+			auto res = evt->get_param(0)->as<int64_t>();
+			if(res >= 0) {
+				// Only if successful
+				auto dirfd = evt->get_param(1)->as<int64_t>();
+				evt->set_fd_info(evt->get_tinfo()->get_fd(dirfd));
+			}
 		}
 		break;
 	}
 	case PPME_SYSCALL_SYMLINKAT_X: {
-		auto res = evt->get_param(0)->as<int64_t>();
-		if(res >= 0) {
-			// Only if successful
-			auto dirfd = evt->get_param(2)->as<int64_t>();
-			evt->set_fd_info(evt->get_tinfo()->get_fd(dirfd));
+		if (evt->get_tinfo() != nullptr) {
+			auto res = evt->get_param(0)->as<int64_t>();
+			if(res >= 0) {
+				// Only if successful
+				auto dirfd = evt->get_param(2)->as<int64_t>();
+				evt->set_fd_info(evt->get_tinfo()->get_fd(dirfd));
+			}
 		}
 		break;
 	}