Segmentation fault in CChan::TrimBuffer() #21

New Issue

2026-10-05T03:54:10+02:00

adam commented

2026-10-05 03:54:10 +02:00

There is faulty code in the new TrimBuffer method invoked when the buffer size is shunk.

On lines 535-537:

if (m_vsBuffer.size() > uMax) {
    m_vsBuffer.erase(m_vsBuffer.begin(), m_vsBuffer.begin() + (uMax - m_vsBuffer.size()));
}

The code first checks to see if the buffer size is larger than the max allowed size. It then proceeds to erase from the beginning of the buffer to an offset, calculated by subtracting the larger, old buffer size from the smaller, new buffer size. As this is done with STL iterators, the operation is not quite defined, and the behavior while attempting to erase from the beginning of the vector to an iterator which points to a element before the beginning of the vector is most likely causing a segmentation fault.

To fix, one could simply reverse the order of operands in the subtraction. Trimming the first (oldlen - newlen) elements will result in an accurate new buffer size.

Introduced in: f6113b322d

There is faulty code in the new TrimBuffer method invoked when the buffer size is shunk. On lines 535-537: ``` if (m_vsBuffer.size() > uMax) { m_vsBuffer.erase(m_vsBuffer.begin(), m_vsBuffer.begin() + (uMax - m_vsBuffer.size())); } ``` The code first checks to see if the buffer size is larger than the max allowed size. It then proceeds to erase from the beginning of the buffer to an offset, calculated by subtracting the **larger, old buffer size** from the smaller, new buffer size. As this is done with STL iterators, the operation is not quite defined, and the behavior while attempting to erase from the beginning of the vector to an iterator which points to a element _before_ the beginning of the vector is most likely causing a segmentation fault. To fix, one could simply reverse the order of operands in the subtraction. Trimming the first (oldlen - newlen) elements will result in an accurate new buffer size. --- Introduced in: f6113b322dbb32af6b27b72e3a557e46acf20ffb

adam closed this issue

2026-10-05 03:54:10 +02:00

adam referenced this issue

2026-10-05 03:54:38 +02:00

If you connect without specifying network, you can't join partyline. #29

adam referenced this issue

2026-10-05 03:55:26 +02:00

*Partyline should use &#channels instead of ~#channels #42

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#21