[PATCH 1/4] libkeymap: prevent NULL dereference in parser

Krdyan Areg <[email protected]> Sat, 14 Feb 2026 20:27:30 +0300
Newsgroups dev.linux.lists.kbd
Message-ID <[email protected]>
The parser accesses ctx->key_line array elements without checking if
lk_array_get() returns NULL, which can lead to crashes.

Add NULL checks before dereferencing array values.

Signed-off-by: Krdyan Areg [email protected]
---
 src/libkeymap/parser.y | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/libkeymap/parser.y b/src/libkeymap/parser.y
index 2cd509f..a87fb54 100644
--- a/src/libkeymap/parser.y
+++ b/src/libkeymap/parser.y
@@ -320,6 +320,9 @@ singleline	: KEYCODE NUMBER EQUALS rvalue0 EOL
 
 							if (i < ctx->key_line->count) {
 								val = lk_array_get(ctx->key_line, i);
+								if (!val)
+									YYERROR;
+
 								keycode = *val;
 							}
 
@@ -338,7 +341,7 @@ singleline	: KEYCODE NUMBER EQUALS rvalue0 EOL
 					for (i = 0; i < ctx->key_line->count; i++) {
 						val = lk_array_get(ctx->key_line, i);
 
-						if (lk_add_key(ctx, i, $2, *val) < 0)
+						if (!val || lk_add_key(ctx, i, $2, *val) < 0)
 							YYERROR;
 					}
 				}
-- 
2.52.0