Skip to content

A use-after-free vulnerability #601

@ycaibb

Description

@ycaibb

Hi, there is a potential use-after-free bug, if you think so please confirm and fix

In the file coturn/src/server/ns_turn_server.cm, the write_client_connection(line 4276) freed the nbh at 4293 and use it at line 4297.

int ret = send_data_from_ioa_socket_nbh(ss->client_socket, NULL, nbh, ttl, tos, &skip); // line 4293

ss->sent_bytes += (uint32_t)ioa_network_buffer_get_size(nbh); //4297

The send_data_from_ioa_socket_nbh function is in coturn/src/apps/relay/ns_ioalib_engine_impl.c and the free operation is ioa_network_buffer_delete(s->e, nbh) at line 3250 and 3136.

Thank you
Ryan

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions