From c9447423dc565b6241437e0161c73c015919ae36 Mon Sep 17 00:00:00 2001
From: Levi Neely <lkn@darkstar.example.net>
Date: Tue, 3 Mar 2026 15:06:04 +0100
Subject: [PATCH] Fix use-after-free: heap-allocate socket fd for RPC threads

Stack variable cl in prpc_main_loop() is passed by address to threads.
Thread dereferences it after the stack frame may be reused by next accept().

Heap-allocate the fd, pass pointer to thread, free in on_request cleanup.

Fixes #236
---
 pclsync/prpc.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pclsync/prpc.c b/pclsync/prpc.c
index 038bc6e..49556bd 100644
--- a/pclsync/prpc.c
+++ b/pclsync/prpc.c
@@ -122,6 +122,7 @@ static void on_request(void *lpvParam) {
 cleanup:
   if (sockfd) {
     close(*sockfd);
+    free(sockfd);
   }
   if (response) {
     free(response);
@@ -265,10 +266,18 @@ void prpc_main_loop() {
       continue;
     }
 
+    int *cl_ptr = malloc(sizeof(int));
+    if (!cl_ptr) {
+      pdbg_logf(D_ERROR, "Failed to allocate memory for socket fd");
+      close(cl);
+      continue;
+    }
+    *cl_ptr = cl;
+
     // handle the request in a new thread
     prun_thread1("Pipe request handle routine",
                       on_request, // thread proc
-                      (void *)&cl                   // thread parameter
+                      (void *)cl_ptr                   // thread parameter
     );
   }