inspector: fix crash when writing to closed inspector socket

ProtocolHandler::WriteRaw() dereferences tcp_ without a null check.
When the remote end disconnects, OnEof() resets tcp_ to nullptr, but
queued messages from the uv_async callback can still trigger Write()
on the same event loop iteration, causing a null pointer dereference
crash (EXCEPTION_ACCESS_VIOLATION on Windows).

Additionally, ParseWsFrames() can call OnEof() internally (on
compressed or error frames), which resets tcp_ mid-loop in OnData().
If the delegate callback triggered by OnWsFrame() then calls Write(),
it would also hit the null tcp_ crash.

Add null guards in:
- WsHandler::OnData: stop parsing loop when tcp_ becomes null
- WsHandler::Write: early return before frame encoding
- ProtocolHandler::WriteRaw: defensive fallback for all write paths

Fixes: https://github.com/nodejs/node/issues/34833
Signed-off-by: piaoyingmin <piaoyingmin@bytedance.com>
PR-URL: https://github.com/nodejs/node/pull/64209
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
This commit is contained in:
ympark2011 authored and GitHub committed 2026-07-06 14:05:50 +00:00
1 parent 90fbf0ec0a
commit 8a84e6be90
1 file changed
+3 -1
+3 -1
View File
@@ -401,10 +401,11 @@ class WsHandler : public ProtocolHandler {
if (processed > 0) {
remove_from_beginning(data, processed);
}
} while (processed > 0 && !data->empty());
} while (processed > 0 && !data->empty() && tcp_);
}
void Write(const std::vector<char> data) override {
if (!tcp_) return;
std::vector<char> output = encode_frame_hybi17(data);
WriteRaw(output, WriteRequest::Cleanup);
}
@@ -666,6 +667,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector,
int ProtocolHandler::WriteRaw(const std::vector<char>& buffer,
uv_write_cb write_cb) {
if (!tcp_) return -1;
return tcp_->WriteRaw(buffer, write_cb);
}