Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: Use after free in network invalid packet error path #11016

Closed
JGRennison opened this issue Jun 15, 2023 · 0 comments
Closed

[Bug]: Use after free in network invalid packet error path #11016

JGRennison opened this issue Jun 15, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@JGRennison
Copy link
Contributor

Version of OpenTTD

master

Expected result

No bugs, etc

Actual result

CloseConnection in NetworkGameSocketHandler::HandlePacket calls delete this.
this is still used afterwards in NetworkGameSocketHandler::HandlePacket.
In the case of clients, this then gets used to try to send an error to the server in ClientNetworkGameSocketHandler::Receive which fairly reliably causes a crash.

Steps to reproduce

See above and/or inject a packet fault.
JGRennison added a commit to JGRennison/Upstream-OpenTTD that referenced this issue Jun 16, 2023
@JGRennison
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
7ac2dcc 
…ndlers

This fixes various use after free scenarios in error handling paths
JGRennison added a commit to JGRennison/Upstream-OpenTTD that referenced this issue Jun 16, 2023
@JGRennison
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
45a1de1 
…ndlers

This fixes various use after free scenarios in error handling paths
JGRennison added a commit to JGRennison/Upstream-OpenTTD that referenced this issue Jun 17, 2023
@JGRennison
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
0eaf924 
…ndlers

This fixes various use after free scenarios in error handling paths
@2TallTyler 2TallTyler added the bug Something isn't working label Jun 19, 2023
@PeterN PeterN closed this as completed in 4f6d75f Jun 25, 2023
LordAro pushed a commit to LordAro/OpenTTD that referenced this issue Jun 28, 2023
@JGRennison @LordAro
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
690e5db 
…ndlers

This fixes various use after free scenarios in error handling paths
LordAro pushed a commit that referenced this issue Jun 28, 2023
@JGRennison @LordAro
Fix #11016: Defer deletion of client and server game socket handlers
5150f3b 
This fixes various use after free scenarios in error handling paths
mrmbernardi pushed a commit to mrmbernardi/OpenTTD that referenced this issue Jul 2, 2023
@JGRennison @mrmbernardi
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
6eb4249 
…ndlers

This fixes various use after free scenarios in error handling paths
shoter pushed a commit to shoter/OpenTTD that referenced this issue Jul 16, 2023
@JGRennison @shoter
Fix OpenTTD#11016: Defer deletion of client and server game socket ha…
3ea8678 
…ndlers

This fixes various use after free scenarios in error handling paths
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@JGRennison @2TallTyler