adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Use after free in shell module #336

New Issue
Closed
opened 2026-10-05 04:13:53 +02:00 by adam · 2 comments
adam commented 2026-10-05 04:13:53 +02:00
Owner
Copy link
Copy source

If a client runs a shell command and then disconnects before the command completes, the CShellSock::m_pClient will become stale. Later, in CShellSock::ReadLine, this stale pointer will be used after being freed.

I solved this in my own implementation by overriding OnClientDisconnect in CShellMod, in which I issue CShellSock::Kill for all shell sockets owned by a particular client, and then set their m_pClients to NULL. If that field is NULL in CShellSock::ReadLine, any data read is discarded. (Killing the process behind the socket won't empty the socket, so we have to make sure we drop data that made it in)

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

If a client runs a shell command and then disconnects before the command completes, the CShellSock::m_pClient will become stale. Later, in CShellSock::ReadLine, this stale pointer will be used after being freed. I solved this in my own implementation by overriding OnClientDisconnect in CShellMod, in which I issue CShellSock::Kill for all shell sockets owned by a particular client, and then set their m_pClients to NULL. If that field is NULL in CShellSock::ReadLine, any data read is discarded. (Killing the process behind the socket won't empty the socket, so we have to make sure we drop data that made it in) ## <bountysource-plugin> Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/2475192-use-after-free-in-shell-module?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin> <!-- github-sync-id:34847897 -->
adam closed this issue 2026-10-05 04:13:53 +02:00
adam commented 2026-10-05 04:13:54 +02:00
Author
Owner
Copy link
Copy source

Pull request?

Pull request? <!-- github-comment-id:68858262 -->
adam commented 2026-10-05 04:13:55 +02:00
Author
Owner
Copy link
Copy source

Fixed in #1248

Fixed in #1248 <!-- github-comment-id:450726058 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#336