Potential Null Pointer Dereference found due to Unreasonable Check
Author: MicroMiloCreated Oct 14, 2025Updated Jul 26, 2026
In the function turnports_allocate, due to the Unreasonable Check, I think there is a possibility of causing NPD.
In language C, the priority of operations of -> is greater than &.
The code in the function checks if the variable tp NULL; However, if it is NULL, the NPD has happened due to the -> operation.
case 1
int turnports_allocate(turnports *tp) {
int port = -1;
TURN_MUTEX_LOCK(&tp->mutex); // ============ NPD here
if (tp) { // ======== post check here.
//..
}
TURN_MUTEX_UNLOCK(&tp->mutex);
return port;
}case 2
The same thing happens in the function turnports_release
void turnports_release(turnports *tp, uint16_t port) {
TURN_MUTEX_LOCK(&tp->mutex); // ========== NPD here
if (tp && port >= tp->range_start && port <= tp->range_stop) { // ======== post check here.
const uint16_t position = (uint16_t)(tp->high & 0x0000FFFF);
if (is_taken(tp->status[port])) {
tp->status[port] = tp->high;
tp->ports[position] = port;
++(tp->high);
}
}
TURN_MUTEX_UNLOCK(&tp->mutex);
}case 3
Something more terrible happens in the function turnports_allocate_even, it checks if tp is NULL first; however, when tp is NULL, it will execute the code of TURN_MUTEX_UNLOCK(&tp->mutex);, which will cause NPD directly.
int turnports_allocate_even(turnports *tp, int allocate_rtcp, uint64_t *reservation_token) {
if (tp) { // =============== pre check here
TURN_MUTEX_LOCK(&tp->mutex);
//..
}
TURN_MUTEX_UNLOCK(&tp->mutex); // ============ NPD here
return -1;
}Source: coturn/coturn