Skip to content

fix: nil pointer dereference in ScanTLS when no cert has DNSNames#40

Merged
yuhan6665 merged 1 commit into
XTLS:mainfrom
larinkonstantin:main
May 30, 2026
Merged

fix: nil pointer dereference in ScanTLS when no cert has DNSNames#40
yuhan6665 merged 1 commit into
XTLS:mainfrom
larinkonstantin:main

Conversation

@larinkonstantin
Copy link
Copy Markdown
Contributor

Fixes #39

PROBLEM
ScanTLS panics with a nil pointer dereference when none of the peer certificates contain DNSNames (e.g. certificates that only use Subject.CommonName).

panic: runtime error: invalid memory address or nil pointer dereference
  [signal SIGSEGV: segmentation violation code=0x2 addr=0x90 pc=0x102cd96f0]

  goroutine 11 [running]:
  main.ScanTLS(...)
          scanner.go:76

ROOT CAUSE
leaf was declared as var leaf *x509.Certificate and only assigned inside the loop if a certificate had DNSNames. If no such certificate existed, leaf remained nil. It was then unconditionally dereferenced in the slog call at the end of the function, even for non-feasible hosts.

FIX
Initialize leaf to the first certificate before the loop and override it with the first certificate that has DNSNames if one is found.

@yuhan6665
Copy link
Copy Markdown
Member

Thanks for your fix!

@yuhan6665 yuhan6665 merged commit fadc018 into XTLS:main May 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

runtime error: invalid memory address or nil pointer dereference

2 participants