Added some crash checks.

activitypub.c

@@ -2323,6 +2323,12 @@ int activitypub_post_handler(const xs_dict *req, const char *q_path,
         return 400;
     }
 
+    if (xs_is_null(payload)) {
+        *body  = xs_str_new("no payload");
+        *ctype = "text/plain";
+        return 400;
+    }
+
     if (xs_str_in(i_ctype, "application/activity+json") == -1 &&
         xs_str_in(i_ctype, "application/ld+json") == -1)
         return 0;

httpd.c

@@ -382,7 +382,7 @@ void httpd_connection(FILE *f)
     srv_archive("RECV", NULL, req, payload, p_size, status, headers, body, b_size);
 
     /* JSON validation check */
-    if (strcmp(ctype, "application/json") == 0) {
+    if (!xs_is_null(body) && strcmp(ctype, "application/json") == 0) {
         xs *j = xs_json_loads(body);
 
         if (j == NULL) {