fix: add NULL pointer check in rcl_client_bindings.cpp (CWE-476)

[anupamme]

The CreateClient function allocates memory for rcl_client_t using malloc() without checking if the allocation succeeded. If malloc returns NULL due to memory exhaustion, the code immediately dereferences the NULL pointer, causing a segmentation fault and application crash. The affected code is src/rcl_client_bindings.cpp:43. This change is the fix I would apply.

Reference: CWE-476

Fixes #1616

What changed

• src/rcl_client_bindings.cpp

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[minggangw]

Thanks for submitting the PR, please address the lint error below, and create an issue to be linked with the PR.

  /__w/rclnodejs/rclnodejs/src/rcl_client_bindings.cpp:44:  Lines should be <= 80 characters long  [whitespace/line_length] [2]
  
  /__w/rclnodejs/rclnodejs/scripts/cpplint.cjs:38
          throw Error('cpplint failed.');
          ^
  
  Error: cpplint failed.
      at /__w/rclnodejs/rclnodejs/scripts/cpplint.cjs:38:15
      at ChildProcess.exithandler (node:child_process:424:5)
      at ChildProcess.emit (node:events:514:28)
      at maybeClose (node:internal/child_process:1141:16)
      at ChildProcess._handle.onexit (node:internal/child_process:306:5)

[anupamme]

Thanks for submitting the PR, please address the lint error below, and create an issue to be linked with the PR.

  /__w/rclnodejs/rclnodejs/src/rcl_client_bindings.cpp:44:  Lines should be <= 80 characters long  [whitespace/line_length] [2]
  
  /__w/rclnodejs/rclnodejs/scripts/cpplint.cjs:38
          throw Error('cpplint failed.');
          ^
  
  Error: cpplint failed.
      at /__w/rclnodejs/rclnodejs/scripts/cpplint.cjs:38:15
      at ChildProcess.exithandler (node:child_process:424:5)
      at ChildProcess.emit (node:events:514:28)
      at maybeClose (node:internal/child_process:1141:16)
      at ChildProcess._handle.onexit (node:internal/child_process:306:5)

Addressed. Pls review.

[coveralls]

coverage: 91.136%. remained the same — anupamme:fix-repo-rclnodejs-cwe-476-client-malloc-null-check into RobotWebTools:develop

[minggangw]

LGTM!

[Copilot]

Copilot review overview

🟢 Approval recommended

The guard safely handles allocation failure before dereferencing the pointer.

Review effort: Balanced
Findings: None

What changed in this PR

Prevents a native crash when client memory allocation fails.

Changes:

• Adds a null check before initializing the allocated rcl_client_t.

File	Description
src/​rcl_client_bindings.cpp	Throws a JavaScript-visible error when client allocation fails.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.