Fix null pointer deref for unknown class names.

PiperOrigin-RevId: 610391077
Change-Id: I5abd62ff46e31e788f06fe111adb3c25287d4fdc

src/user/user_api.cc

@@ -346,6 +346,18 @@ mjmDefault* mjm_getDefault(mjElement element) {
 
 
 
+// find default in model by class name
+mjmDefault* mjm_findDefault(mjmModel* modelspec, const char* classname) {
+  mjCModel* model = reinterpret_cast<mjCModel*>(modelspec->element);
+  mjCDef* cdef = model->FindDef(classname);
+  if (!cdef) {
+    return nullptr;
+  }
+  return &cdef->spec;
+}
+
+
+
 // find body in model by name
 mjmBody* mjm_findBody(mjmModel* modelspec, const char* name) {
   mjCModel* model = reinterpret_cast<mjCModel*>(modelspec->element);

src/user/user_api.h

@@ -821,6 +821,9 @@ MJAPI mjmModel* mjm_getModel(mjmBody* body);
 // Get default corresponding to an mjElement.
 MJAPI mjmDefault* mjm_getDefault(mjElement element);
 
+// Find default in model by class name.
+MJAPI mjmDefault* mjm_findDefault(mjmModel* model, const char* classname);
+
 // Find body in model by name.
 MJAPI mjmBody* mjm_findBody(mjmModel* model, const char* name);
 

src/xml/xml_native_reader.cc

@@ -31,8 +31,8 @@
 
 #include <mujoco/mjmodel.h>
 #include <mujoco/mjplugin.h>
-#include <mujoco/mjvisualize.h>
 #include <mujoco/mjtnum.h>
+#include <mujoco/mjvisualize.h>
 #include "engine/engine_plugin.h"
 #include "engine/engine_util_errmem.h"
 #include "engine/engine_util_misc.h"
@@ -3986,12 +3986,14 @@ void mjXReader::Keyframe(XMLElement* section) {
 // get defaults class
 mjmDefault* mjXReader::GetClass(XMLElement* section) {
   string text;
-  mjmDefault* def = 0;
+  mjmDefault* def = nullptr;
 
   if (ReadAttrTxt(section, "class", text)) {
-    def = &model->FindDef(text)->spec;
+    def = mjm_findDefault(&model->spec, text.c_str());
     if (!def) {
-      throw mjXError(section, "unknown default class");
+      throw mjXError(
+          section,
+          std::string("unknown default class name '" + text + "'").c_str());
     }
   }