From e167600ca974c388bff3761faf895a257a62ed7e Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Sun, 31 May 2026 20:16:05 -0700
Subject: [PATCH] Null-check plugin-supplied pointers in v1 Scripts API

The three Scripts entry points in v1::Funcs forwarded their raw
pointer arguments straight into std::filesystem::path / std::string
constructors downstream, both of which are UB on nullptr. A plugin
that called Scripts::Add(handle, nullptr) or
RegisterNeverRefType(nullptr) / RegisterMixedRefType(nullptr) would
crash the game process.

Mirror the existing pattern in v1/Logger.cpp: reject nullptr at the
boundary, log a warning, and return false without forwarding the
call.

Fixes #137

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/dll/v1/Funcs.cpp | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/dll/v1/Funcs.cpp b/src/dll/v1/Funcs.cpp
index 51a15275..a251341c 100644
--- a/src/dll/v1/Funcs.cpp
+++ b/src/dll/v1/Funcs.cpp
@@ -122,6 +122,12 @@ bool v1::GameStates::Add(RED4ext::v1::PluginHandle aHandle, RED4ext::EGameStateT
 
 bool v1::Scripts::Add(RED4ext::v1::PluginHandle aHandle, const wchar_t* aPath)
 {
+    if (!aPath)
+    {
+        spdlog::warn("Plugin with handle {} called Scripts::Add with a NULL path", fmt::ptr(aHandle));
+        return false;
+    }
+
     auto app = App::Get();
     if (!app)
     {
@@ -140,6 +146,12 @@ bool v1::Scripts::Add(RED4ext::v1::PluginHandle aHandle, const wchar_t* aPath)
 
 bool v1::Scripts::RegisterNeverRefType(const char* aType)
 {
+    if (!aType)
+    {
+        spdlog::warn("Scripts::RegisterNeverRefType called with a NULL type name");
+        return false;
+    }
+
     auto app = App::Get();
     if (!app)
     {
@@ -153,6 +165,12 @@ bool v1::Scripts::RegisterNeverRefType(const char* aType)
 
 bool v1::Scripts::RegisterMixedRefType(const char* aType)
 {
+    if (!aType)
+    {
+        spdlog::warn("Scripts::RegisterMixedRefType called with a NULL type name");
+        return false;
+    }
+
     auto app = App::Get();
     if (!app)
     {