eggdrop
eggdrop copied to clipboard
Crash fix heap-use-after-free
Found by: https://github.com/michaelortmann/ Patch by: https://github.com/michaelortmann/ Fixes:
One-line summary: Fix a pointer in dcc table linking into dcc table. We must not do that because dcc table can be realloced
Additional description (if needed): Between dns resolve start and finish, realloc can happen here: https://github.com/eggheads/eggdrop/blob/d317ac228eb6682fdd6386007e09d627efd618ca/src/dccutil.c#L89 like when someone connects to the eggdrrop at the right moment Its a heap-use-after-free When investigating the code i realized the dns_info.ip pointer is redundant, and the fix equals a cleanup.
Test cases demonstrating functionality (if applicable):
==444524==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0d8c608f58 at pc 0x559353b0b799 bp 0x7ffc6235d370 sp 0x7ffc6235d360
READ of size 4 at 0x7d0d8c608f58 thread T0
#0 0x559353b0b798 in dns_dcchostbyip /home/michael/projects/eggdrop/src/dns.c:153
[...]
0x7d0d8c608f58 is located 3672 bytes inside of 4560-byte region [0x7d0d8c608100,0x7d0d8c6092d0)
freed by thread T0 here:
#0 0x7efd8ef1fa45 in realloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:81
#1 0x559353b3a356 in n_realloc /home/michael/projects/eggdrop/src/mem.c:388
#2 0x559353afdde4 in increase_socks_max /home/michael/projects/eggdrop/src/dccutil.c:89
[...]
==444524==ABORTING