From 2792d63f9253fb07611f07dbd8af24d3381dadf8 Mon Sep 17 00:00:00 2001
From: Scott Zager <scott.zager@gmail.com>
Date: Sat, 18 Jul 2026 19:56:45 -0400
Subject: [PATCH] fix: add NULL checks after strtok in handleFaupCommand

A client sending a field name without a value (e.g. 'upload_rate_multiplier\t')
caused strtok to return NULL, which was passed to atof/atoi, crashing the
process.

Fixes #302
---
 net_io.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net_io.c b/net_io.c
index 8abd51086..4e58fff53 100644
--- a/net_io.c
+++ b/net_io.c
@@ -1148,6 +1148,8 @@ static int handleFaupCommand(struct client *c, char *p) {
     while (msg_field != NULL) {
         if (!strcmp(msg_field, "upload_rate_multiplier")) {
             msg_field = strtok (NULL, "\t");
+            if (msg_field == NULL)
+                break;
             multiplier = atof(msg_field);
 
             // Sanity check on multiplier value
@@ -1163,6 +1165,8 @@ static int handleFaupCommand(struct client *c, char *p) {
 
         if (!strcmp(msg_field, "upload_unknown_commb")) {
             msg_field = strtok (NULL, "\t");
+            if (msg_field == NULL)
+                break;
             unsigned enable = atoi(msg_field);
             fprintf(stderr, "handleFaupCommand(): %s upload of unknown Comm-B messages\n", enable ? "Enabling" : "Disabling");
             Modes.faup_upload_unknown_commb = enable;