Author: Andy Green <andy@warmcat.com>
Date: Sun Oct 04 05:09:03 2026 +0100

server: don't deref a NULL vhd at PROTOCOL_DESTROY

If PROTOCOL_INIT failed before the vhd was allocated, PROTOCOL_DESTROY
still comes, and we checked vhd for the link vhost test only to pass it
to sais_server_destroy() and sais_idle_destroy() anyway.

Coverity CID 506320

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>


diff --git a/src/server/s-comms.c b/src/server/s-comms.c
index 91ba771..3661a85 100644
--- a/src/server/s-comms.c
+++ b/src/server/s-comms.c
@@ -464,7 +464,10 @@ s_callback_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		break;
 
 	case LWS_CALLBACK_PROTOCOL_DESTROY:
-		if (vhd && vhd->vhost == sais_link_vhost)
+		/* we may have failed init before allocating it */
+		if (!vhd)
+			goto passthru;
+		if (vhd->vhost == sais_link_vhost)
 			sais_link_vhost = NULL;
 		sais_server_destroy(vhd, &vhd->server);
 		sais_idle_destroy(vhd);