Skip to content

Fix user-after-free in network code#666

Open
Mizarka wants to merge 1 commit intoTelegramMessenger:masterfrom
Mizarka:useafterfree
Open

Fix user-after-free in network code#666
Mizarka wants to merge 1 commit intoTelegramMessenger:masterfrom
Mizarka:useafterfree

Conversation

@Mizarka
Copy link

@Mizarka Mizarka commented Feb 11, 2026

Current code frees the C handle, which is used afterwards in a call to free_mp_queue (C->free_block_queue);, resulting in a classic use-after-free for which GCC rightfully complains:

net/net-msg-buffers.c:307:23: warning: pointer ‘C’ may be used after ‘free’ [-Wuse-after-free]
  307 |   C->free_block_queue = NULL;
      |                       ^
net/net-msg-buffers.c:294:3: note: call to ‘free’ here
  294 |   free (C);
      |   ^~~~~~~~
net/net-msg-buffers.c:306:3: warning: pointer ‘C’ may be used after ‘free’ [-Wuse-after-free]
  306 |   free_mp_queue (C->free_block_queue);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/net-msg-buffers.c:294:3: note: call to ‘free’ here
  294 |   free (C);
      |   ^~~~~~~~

This PR fixes it by simply freeing at the very tail end of the function.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant