adam/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-08-03 07:23:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a user-after-free bug

Browse Source 
When a user is deleted we didn't properly clean up after it. Active DCC
connections (CDCCBounce and CDCCSock) where left laying around and at some later
point of time they used their CUser* pointer which now pointed to invalid data.

This bug is similar to the one from r1557.

Thanks to cnu, our beloved master of destruction, for finding yet another way to
make ZNC break and for testing the patch.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1575 726aef4b-f618-498e-8847-2d620e286838
This commit is contained in:
psychon
2009-07-22 16:54:52 +00:00
parent 6c1014f200
commit f8178e9bc8
5 changed files with 65 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
User.cpp
+7
View File
@@ -69,6 +69,13 @@ CUser::~CUser() {
delete m_vChans[b];
}
// This will cause an endless loop if the destructor doesn't remove the
// socket from this list / if the socket doesn't exist any more.
while (!m_sDCCBounces.empty())
CZNC::Get().GetManager().DelSockByAddr((CZNCSock*) *m_sDCCBounces.begin());
while (!m_sDCCSocks.empty())
CZNC::Get().GetManager().DelSockByAddr((CZNCSock*) *m_sDCCSocks.begin());
CZNC::Get().GetManager().DelCronByAddr(m_pJoinTimer);
CZNC::Get().GetManager().DelCronByAddr(m_pMiscTimer);
}