From 6dc017337d1b19653a32c90f1ee134952c2397d5 Mon Sep 17 00:00:00 2001 From: evgeny Date: Tue, 15 Sep 2026 21:52:46 +0300 Subject: [PATCH] =?UTF-8?q?chat:=20fix=20UAF=20=D0=B2=20member=20list=20tr?= =?UTF-8?q?ampoline=20(req->inst=20=D0=BF=D0=BE=D1=81=D0=BB=D0=B5=20u=5Ffr?= =?UTF-8?q?ee)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/chat/chat_member.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/chat/chat_member.c b/src/chat/chat_member.c index 805f62de..e740096c 100644 --- a/src/chat/chat_member.c +++ b/src/chat/chat_member.c @@ -300,12 +300,13 @@ int chat_core_get_single_member(struct UTUN_INSTANCE* inst, const char* ch_id, u void chat_core_request_member_list_trampoline(void* arg) { struct chat_member_list_req* req = (struct chat_member_list_req*)arg; if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; } + struct UTUN_INSTANCE* inst = req->inst; char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0'; u_free(arg); uint8_t* members = NULL; int count = 0; - if (chat_core_get_member_list(req->inst, ch_id, &members, &count) != 0 || !members) return; + if (chat_core_get_member_list(inst, ch_id, &members, &count) != 0 || !members) return; size_t ch_len = strlen(ch_id); size_t evt_sz = 1 + ch_len + 2 + (size_t)count * CHAT_MEMBER_DISPLAY_SIZE; @@ -317,7 +318,7 @@ void chat_core_request_member_list_trampoline(void* arg) { memcpy(evt + 1, ch_id, ch_len); memcpy(evt + 1 + ch_len, &u16cnt, 2); memcpy(evt + 1 + ch_len + 2, members, (size_t)count * CHAT_MEMBER_DISPLAY_SIZE); - chat_event_post(req->inst, CHAT_EVT_MEMBER_LIST, evt, (int)evt_sz); + chat_event_post(inst, CHAT_EVT_MEMBER_LIST, evt, (int)evt_sz); u_free(evt); u_free(members); @@ -326,12 +327,13 @@ void chat_core_request_member_list_trampoline(void* arg) { void chat_core_request_member_rtt_trampoline(void* arg) { struct chat_member_list_req* req = (struct chat_member_list_req*)arg; if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; } + struct UTUN_INSTANCE* inst = req->inst; char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0'; u_free(arg); uint8_t* members = NULL; int count = 0; - if (chat_core_get_member_list(req->inst, ch_id, &members, &count) != 0 || !members) return; + if (chat_core_get_member_list(inst, ch_id, &members, &count) != 0 || !members) return; size_t ch_len = strlen(ch_id); size_t evt_sz = 1 + ch_len + 1 + CHAT_MEMBER_DISPLAY_SIZE; @@ -348,7 +350,7 @@ void chat_core_request_member_rtt_trampoline(void* arg) { memcpy(evt + 1, ch_id, ch_len); evt[1 + ch_len] = 1; memcpy(evt + 1 + ch_len + 1, members + i * CHAT_MEMBER_DISPLAY_SIZE, CHAT_MEMBER_DISPLAY_SIZE); - chat_event_post(req->inst, CHAT_EVT_MEMBER_UPDATED, evt, (int)evt_sz); + chat_event_post(inst, CHAT_EVT_MEMBER_UPDATED, evt, (int)evt_sz); } u_free(evt);