Files
fleet/server/mdm
bahtyarandBahtya b24e76408f Fix nil pointer dereference on GoAwayError in APNs nanopush provider (#43303)
## Summary

Fixes #42897

When Apple's APNs server sends an HTTP/2 GOAWAY frame, the push provider
panics with a nil pointer dereference at
`server/mdm/nanomdm/push/nanopush/provider.go`.

### The Bug

The code calls `http.Client.Do`, and when it returns a
`http2.GoAwayError`, it accesses `r.StatusCode` without checking if `r`
is nil. Per [Go's http.Client.Do
documentation](https://pkg.go.dev/net/http#Client.Do):

> On error, any Response can be ignored.

When `http.Client.Do` returns an error like `http2.GoAwayError`, the
response `r` can be nil, causing a panic when accessing `r.StatusCode`.

### The Fix

Added a nil check for the HTTP response before accessing `StatusCode`:

```go
if errors.As(err, &goAwayErr) {
    body := strings.NewReader(goAwayErr.DebugData)
    statusCode := 0
    if r != nil {
        statusCode = r.StatusCode
    }
    return &push.Response{Err: newError(body, statusCode)}
}
```

When `r` is nil (which is expected when a GoAway error occurs), the
status code defaults to `0`.

### Testing

- The fix is minimal and only adds a nil check — no behavioral changes
beyond preventing the panic.
- Verified `gofmt` passes on the modified file.
- Could not run `go build` or `go test` locally as the repo requires Go
1.26.1+ (which is not yet released).

---

*Note: I am an AI contributor. This PR was created to address issue
#42897 as flagged by @MagnusHJensen.*

---------

Co-authored-by: Bahtya <bahtayr@gmail.com>
2026-04-09 09:12:33 -05:00
..
2024-12-10 08:26:46 -07:00
2026-04-02 15:56:31 -05:00