inspector: fix crash when writing to closed inspector socket

Yayapapa · richardlau · commit eb2e96bc28b6 · 2026-07-06T14:13:10.000Z
ProtocolHandler::WriteRaw() dereferences tcp_ without a null check. When the remote end disconnects, OnEof() resets tcp_ to nullptr, but queued messages from the uv_async callback can still trigger Write() on the same event loop iteration, causing a null pointer dereference crash (EXCEPTION_ACCESS_VIOLATION on Windows). Additionally, ParseWsFrames() can call OnEof() internally (on compressed or error frames), which resets tcp_ mid-loop in OnData(). If the delegate callback triggered by OnWsFrame() then calls Write(), it would also hit the null tcp_ crash. Add null guards in: - WsHandler::OnData: stop parsing loop when tcp_ becomes null - WsHandler::Write: early return before frame encoding - ProtocolHandler::WriteRaw: defensive fallback for all write paths Fixes: #34833 Signed-off-by: piaoyingmin <piaoyingmin@bytedance.com> PR-URL: #64209 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc
@@ -401,10 +401,11 @@ class WsHandler : public ProtocolHandler {
       if (processed > 0) {
         remove_from_beginning(data, processed);
       }
-    } while (processed > 0 && !data->empty());
+    } while (processed > 0 && !data->empty() && tcp_);
   }
 
   void Write(const std::vector<char> data) override {
+    if (!tcp_) return;
     std::vector<char> output = encode_frame_hybi17(data);
     WriteRaw(output, WriteRequest::Cleanup);
   }
@@ -666,6 +667,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector,
 
 int ProtocolHandler::WriteRaw(const std::vector<char>& buffer,
                               uv_write_cb write_cb) {
+  if (!tcp_) return -1;
   return tcp_->WriteRaw(buffer, write_cb);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -401,10 +401,11 @@ class WsHandler : public ProtocolHandler {`
`401`	`401`	`if (processed > 0) {`
`402`	`402`	`remove_from_beginning(data, processed);`
`403`	`403`	`}`
`404`		`- } while (processed > 0 && !data->empty());`
	`404`	`+ } while (processed > 0 && !data->empty() && tcp_);`
`405`	`405`	`}`
`406`	`406`
`407`	`407`	`void Write(const std::vector<char> data) override {`
	`408`	`+ if (!tcp_) return;`
`408`	`409`	`std::vector<char> output = encode_frame_hybi17(data);`
`409`	`410`	`WriteRaw(output, WriteRequest::Cleanup);`
`410`	`411`	`}`
`@@ -666,6 +667,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector,`
`666`	`667`
`667`	`668`	`int ProtocolHandler::WriteRaw(const std::vector<char>& buffer,`
`668`	`669`	`uv_write_cb write_cb) {`
	`670`	`+ if (!tcp_) return -1;`
`669`	`671`	`return tcp_->WriteRaw(buffer, write_cb);`
`670`	`672`	`}`
`671`	`673`