From 0be142b8c9934c3cce43abca755eca1f22144320 Mon Sep 17 00:00:00 2001 From: tiptorrent development team Date: Mon, 13 Sep 2021 13:36:42 +0200 Subject: disarm timer on release This is a repeat timer, if not stopped, it will run again triggering UAF. --- src/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'src') diff --git a/src/core.c b/src/core.c index 0da582c..952e1b0 100644 --- a/src/core.c +++ b/src/core.c @@ -40,6 +40,7 @@ static void tip_client_release(struct ev_loop *loop, struct tip_client *cli) inet_ntoa(cli->addr.sin_addr), htons(cli->addr.sin_port)); list_del(&cli->list); + ev_timer_stop(loop, &cli->timer); ev_io_stop(loop, &cli->io); shutdown(cli->io.fd, SHUT_RDWR); close(cli->io.fd); @@ -196,7 +197,6 @@ shutdown: if (cli->size > FILE_SIZE_THRESHOLD) tip_client_redirect_create(cli); close: - ev_timer_stop(loop, &cli->timer); tip_client_release(loop, cli); } @@ -300,7 +300,6 @@ static void tip_client_write_cb(struct ev_loop *loop, struct ev_io *io, int even } return; close: - ev_timer_stop(loop, &cli->timer); tip_client_release(loop, cli); } -- cgit v1.2.3-18-g5258