Fix use-after-free: heap-allocate socket fd for RPC threads

Stack variable cl in prpc_main_loop() is passed by address to threads.
Thread dereferences it after the stack frame may be reused by next accept().

Heap-allocate the fd, pass pointer to thread, free in on_request cleanup.

Fixes #236
This commit is contained in:
Levi Neely 2026-03-03 15:06:04 +01:00
parent bc943e5b69
commit c9447423dc
1 changed files with 10 additions and 1 deletions

View File

@ -122,6 +122,7 @@ static void on_request(void *lpvParam) {
cleanup:
if (sockfd) {
close(*sockfd);
free(sockfd);
}
if (response) {
free(response);
@ -265,10 +266,18 @@ void prpc_main_loop() {
continue;
}
int *cl_ptr = malloc(sizeof(int));
if (!cl_ptr) {
pdbg_logf(D_ERROR, "Failed to allocate memory for socket fd");
close(cl);
continue;
}
*cl_ptr = cl;
// handle the request in a new thread
prun_thread1("Pipe request handle routine",
on_request, // thread proc
(void *)&cl // thread parameter
(void *)cl_ptr // thread parameter
);
}