From ae56aa9c5ce611deaee981597f5d2679d4f6d480 Mon Sep 17 00:00:00 2001
From: "Roger A. Light" <roger@atchoo.org>
Date: Fri, 22 Aug 2025 15:08:20 +0100
Subject: [PATCH] Fix Coverity Scan #1619416

---
 apps/mosquitto_ctrl/ctrl_shell_dynsec.c       | 5 +++++
 apps/mosquitto_ctrl/ctrl_shell_post_connect.c | 7 ++++++-
 apps/mosquitto_ctrl/ctrl_shell_pre_connect.c  | 4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/apps/mosquitto_ctrl/ctrl_shell_dynsec.c b/apps/mosquitto_ctrl/ctrl_shell_dynsec.c
index 222b02c0..b2775dda 100644
--- a/apps/mosquitto_ctrl/ctrl_shell_dynsec.c
+++ b/apps/mosquitto_ctrl/ctrl_shell_dynsec.c
@@ -620,6 +620,11 @@ static void line_callback(char *line)
 	char *saveptr = NULL;
 	char *command = strtok_r(line, " ", &saveptr);
 
+	if(!command){
+		free(line);
+		return;
+	}
+
 	if(!strcasecmp(command, "addClientRole")){
 		ctrl_shell_command_generic_arg2("addClientRole", "username", "rolename", &saveptr);
 	}else if(!strcasecmp(command, "addGroupClient")){
diff --git a/apps/mosquitto_ctrl/ctrl_shell_post_connect.c b/apps/mosquitto_ctrl/ctrl_shell_post_connect.c
index 0c284298..4f6c772b 100644
--- a/apps/mosquitto_ctrl/ctrl_shell_post_connect.c
+++ b/apps/mosquitto_ctrl/ctrl_shell_post_connect.c
@@ -97,8 +97,13 @@ static void line_callback(char *line)
 	}
 
 	char *saveptr = NULL;
-	char *command = strtok_r(line, " ", &saveptr);
 	bool found = false;
+	char *command = strtok_r(line, " ", &saveptr);
+
+	if(!command){
+		free(line);
+		return;
+	}
 
 	for(size_t i=0; i<sizeof(mod_data)/sizeof(struct module_data); i++){
 		if(!strcasecmp(command, mod_data[i].name)){
diff --git a/apps/mosquitto_ctrl/ctrl_shell_pre_connect.c b/apps/mosquitto_ctrl/ctrl_shell_pre_connect.c
index 97b95389..58ecc342 100644
--- a/apps/mosquitto_ctrl/ctrl_shell_pre_connect.c
+++ b/apps/mosquitto_ctrl/ctrl_shell_pre_connect.c
@@ -104,6 +104,10 @@ static void line_callback(char *line)
 	}
 
 	command = strtok_r(line, " ", &saveptr);
+	if(!command){
+		free(line);
+		return;
+	}
 
 	if(!strcasecmp(command, "auth")){
 		free(data.username);