jeka
/
utun2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Browse Source

chat: fix UAF в member list trampoline (req->inst после u_free)

v2
evgeny 2 weeks ago
parent
73fe99b33f
commit
6dc017337d
1 changed files with 6 additions and 4 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 10
      src/chat/chat_member.c

10
src/chat/chat_member.c
Unescape View File

@ -300,12 +300,13 @@ int chat_core_get_single_member(struct UTUN_INSTANCE* inst, const char* ch_id, u
void chat_core_request_member_list_trampoline(void* arg) { void chat_core_request_member_list_trampoline(void* arg) {
struct chat_member_list_req* req = (struct chat_member_list_req*)arg; struct chat_member_list_req* req = (struct chat_member_list_req*)arg;
if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; } if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; }
struct UTUN_INSTANCE* inst = req->inst;
char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0'; char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0';
u_free(arg); u_free(arg);
uint8_t* members = NULL; uint8_t* members = NULL;
int count = 0; int count = 0;
if (chat_core_get_member_list(req->inst, ch_id, &members, &count) != 0 || !members) return; if (chat_core_get_member_list(inst, ch_id, &members, &count) != 0 || !members) return;
size_t ch_len = strlen(ch_id); size_t ch_len = strlen(ch_id);
size_t evt_sz = 1 + ch_len + 2 + (size_t)count * CHAT_MEMBER_DISPLAY_SIZE; size_t evt_sz = 1 + ch_len + 2 + (size_t)count * CHAT_MEMBER_DISPLAY_SIZE;
@ -317,7 +318,7 @@ void chat_core_request_member_list_trampoline(void* arg) {
memcpy(evt + 1, ch_id, ch_len); memcpy(evt + 1, ch_id, ch_len);
memcpy(evt + 1 + ch_len, &u16cnt, 2); memcpy(evt + 1 + ch_len, &u16cnt, 2);
memcpy(evt + 1 + ch_len + 2, members, (size_t)count * CHAT_MEMBER_DISPLAY_SIZE); memcpy(evt + 1 + ch_len + 2, members, (size_t)count * CHAT_MEMBER_DISPLAY_SIZE);
chat_event_post(req->inst, CHAT_EVT_MEMBER_LIST, evt, (int)evt_sz); chat_event_post(inst, CHAT_EVT_MEMBER_LIST, evt, (int)evt_sz);
u_free(evt); u_free(evt);
u_free(members); u_free(members);
@ -326,12 +327,13 @@ void chat_core_request_member_list_trampoline(void* arg) {
void chat_core_request_member_rtt_trampoline(void* arg) { void chat_core_request_member_rtt_trampoline(void* arg) {
struct chat_member_list_req* req = (struct chat_member_list_req*)arg; struct chat_member_list_req* req = (struct chat_member_list_req*)arg;
if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; } if (!req || !CC(req->inst) || !CC(req->inst)->initialized) { u_free(arg); return; }
struct UTUN_INSTANCE* inst = req->inst;
char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0'; char ch_id[64]; strncpy(ch_id, req->ch_id, sizeof(ch_id) - 1); ch_id[sizeof(ch_id) - 1] = '\0';
u_free(arg); u_free(arg);
uint8_t* members = NULL; uint8_t* members = NULL;
int count = 0; int count = 0;
if (chat_core_get_member_list(req->inst, ch_id, &members, &count) != 0 || !members) return; if (chat_core_get_member_list(inst, ch_id, &members, &count) != 0 || !members) return;
size_t ch_len = strlen(ch_id); size_t ch_len = strlen(ch_id);
size_t evt_sz = 1 + ch_len + 1 + CHAT_MEMBER_DISPLAY_SIZE; size_t evt_sz = 1 + ch_len + 1 + CHAT_MEMBER_DISPLAY_SIZE;
@ -348,7 +350,7 @@ void chat_core_request_member_rtt_trampoline(void* arg) {
memcpy(evt + 1, ch_id, ch_len); memcpy(evt + 1, ch_id, ch_len);
evt[1 + ch_len] = 1; evt[1 + ch_len] = 1;
memcpy(evt + 1 + ch_len + 1, members + i * CHAT_MEMBER_DISPLAY_SIZE, CHAT_MEMBER_DISPLAY_SIZE); memcpy(evt + 1 + ch_len + 1, members + i * CHAT_MEMBER_DISPLAY_SIZE, CHAT_MEMBER_DISPLAY_SIZE);
chat_event_post(req->inst, CHAT_EVT_MEMBER_UPDATED, evt, (int)evt_sz); chat_event_post(inst, CHAT_EVT_MEMBER_UPDATED, evt, (int)evt_sz);
} }
u_free(evt); u_free(evt);

Write Preview
Loading…
Cancel
Save