search

smartnode / telebot

Telegram Bot API in C
https://elmurod.net/telebot
Apache License 2.0
162 stars 38 forks source link

Crash on messages forwarded from chats #60

Closed pt300 closed 8 months ago

pt300 commented 8 months ago

Telebot crashes when freeing updates object if one of the messages was a forward from a chat.

I traced the problem to line 488 in telebot-parser.c, which seems to be a mistake when copy pasting similar code. https://github.com/smartnode/telebot/blob/c74d78d2a4822aa2d475b5627105288132e4b0c2/src/telebot-parser.c#L485-L494 It ought to be msg->forward_from_chat = malloc(sizeof(telebot_chat_t));.

This causes a bug in which msg->forward_from is overwritten with a pointer to uninitialized memory. This causes issues during freeing, as telebot_put_user sees non-null pointers and tries to free them. This causes memory corruption and an eventual crash.