Menu

#1659 Server can crash (double-free) when desktop reconnection fails mid-way (2.8.87)

open
nobody
7
2 days ago
2 days ago
No

Double-free in DesktopServerWatcher::execute() (lines 136-146),
acknowledged by a developer comment in the source.

Flow:

  1. Pipe channels allocated.
  2. otherSide channels deleted (lines 128-133).
  3. onReconnect() called (line 136) - transfers ownership of ownSide
    channels to the reconnection listener.
  4. waitForExit() throws (line 138).
  5. Catch block (lines 143-146) deletes all four pointers again,
    including the two already owned by onReconnect().

Developer comment at line 142: "A potential crash. The channels can
be used (see onReconnect()) after these destroyings."

Attached PoC calls free() twice on the same pointer via msvcrt.dll
and exits with STATUS_HEAP_CORRUPTION (0xC0000374).

Fix: null ownSidePipeChanTo/From after onReconnect() returns.
Version: 2.8.87.

Discussion


Log in to post a comment.

MongoDB Logo MongoDB