any1 / neatvnc

A liberally licensed VNC server library with a clean interface
ISC License
120 stars 30 forks source link

rsa-aes: Fix use after free on close #102

Closed any1 closed 1 year ago

any1 commented 1 year ago
==24553== Invalid read of size 4
==24553==    at 0x487D69F: stream_rsa_aes_read (stream-rsa-aes.c:125)
==24553==    by 0x4870778: stream_read (stream.c:56)
==24553==    by 0x4869093: on_client_event (server.c:1637)
==24553==    by 0x4870E5D: stream_tcp__on_readable (stream-tcp.c:156)
==24553==    by 0x4870ECE: stream_tcp__on_event (stream-tcp.c:183)
==24553==    by 0x4856ABD: aml__handle_event (aml.c:801)
==24553==    by 0x4856D44: aml_dispatch (aml.c:853)
==24553==    by 0x11495C: main (main.c:1584)
==24553==  Address 0x18eb75c8 is 8 bytes inside a block of size 4,096 free'd
==24553==    at 0x484412F: free (vg_replace_malloc.c:974)
==24553==    by 0x4870A48: stream_tcp_destroy (stream-tcp.c:65)
==24553==    by 0x487D3F6: stream_rsa_aes_destroy (stream-rsa-aes.c:52)
==24553==    by 0x48705B3: stream_destroy (stream.c:30)
==24553==    by 0x4864133: client_close (server.c:136)
==24553==    by 0x4864257: client_unref (server.c:154)
==24553==    by 0x486AC05: nvnc_client_close (server.c:2294)
==24553==    by 0x4868FEA: on_client_event (server.c:1624)
==24553==    by 0x48708DD: stream__remote_closed (stream-common.c:40)
==24553==    by 0x4870F7A: stream_tcp_read (stream-tcp.c:203)
==24553==    by 0x487D437: stream_rsa_aes_read_into_buffer (stream-rsa-aes.c:57)
==24553==    by 0x487D69A: stream_rsa_aes_read (stream-rsa-aes.c:124)
==24553==  Block was alloc'd at
==24553==    at 0x48469B3: calloc (vg_replace_malloc.c:1554)
==24553==    by 0x48712EF: stream_new (stream-tcp.c:301)
==24553==    by 0x486945C: on_connection (server.c:1720)
==24553==    by 0x4856ABD: aml__handle_event (aml.c:801)
==24553==    by 0x4856D44: aml_dispatch (aml.c:853)
==24553==    by 0x11495C: main (main.c:1584)
==24553==