iarv/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-05-02 19:42:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a crash bug with auth modules

Browse Source 
If a module like imapauth needs some time to process a login, it's possible that
the client already disconnected by the time the lookup finished. This would then
cause a stale pointer in CAuthBase to be dereferenced.

Fix this remotely exploitable crash bug by adding a new function
CAuthBase::Invalidate(). After this was called, the CAuthBase instance doesn't
do anything at all anymore, especially not dereferencing the (possibly stale)
m_pSock pointer.

This also makes sure that one can only call AcceptLogin() or RefuseLogin() once.

Thanks to Sm0ke0ut for providing backtraces and reporting this bug.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1669 726aef4b-f618-498e-8847-2d620e286838
This commit is contained in:
psychon
2009-11-28 18:53:20 +00:00
parent 13b1295119
commit b0e59f1294
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
modules/webadmin.cpp
View File

@@ -25,7 +25,7 @@ public:
virtual ~CWebAdminAuth() {}
void SetWebAdminSock(CWebAdminSock* pWebAdminSock) { m_pWebAdminSock = pWebAdminSock; }
void Invalidate() { m_pWebAdminSock = NULL; CAuthBase::Invalidate(); }
void AcceptedLogin(CUser& User);
void RefusedLogin(const CString& sReason);
private:
@@ -359,7 +359,7 @@ CWebAdminSock::CWebAdminSock(CWebAdminMod* pModule, const CString& sHostname, un
CWebAdminSock::~CWebAdminSock() {
if (!m_spAuth.IsNull()) {
CWebAdminAuth* pAuth = (CWebAdminAuth*) &(*m_spAuth);
pAuth->SetWebAdminSock(NULL);
pAuth->Invalidate();
}
}