svxreflector: onFrameReceived() dereferences &data.front() on an empty frame → undefined behavior/crash

[MarkRose]

Summary

ReflectorLogic::onFrameReceived() dereferences &data.front() on the received frame vector without first checking that it is non-empty. The framing layer only bounds the maximum payload size, so a zero-length framed payload reaches this handler and makes &data.front() undefined behavior (empty std::vector::front() is UB), typically a crash.

Location

Both the v1 and v2 reflector client logic:

• src/svxlink/svxlink/ReflectorLogic.cpp:1117
• src/svxlink/svxlink/ReflectorV2Logic.cpp:837

void ReflectorLogic::onFrameReceived(FramedTcpConnection*, std::vector<uint8_t>& data)
{
  char *buf = reinterpret_cast<char*>(&data.front());   // UB if data.empty()
  int len = data.size();
  ...

Impact

A peer on the other end of the framed TCP connection that emits an empty frame triggers undefined behavior / a likely crash. On the reflector server side this can be reached by a connected client, taking down the reflector for all users; on the client side by a malicious or malfunctioning reflector.

Suggested fix

Guard against an empty frame before touching front():

if (data.empty())
{
  std::cerr << "*** ERROR[" << name() << "]: Received an empty TCP frame" << std::endl;
  disconnect();
  return;
}
char *buf = reinterpret_cast<char*>(&data.front());

Applies to both onFrameReceived() implementations.