https://gitlab.synchro.net/main/sbbs/-/commit/f95f67ac43c455993a84f03d
Modified Files:
src/sbbs3/sbbs_ini.c
Log Message:
Fix double-free race condition with SBBSCTRL upon global recycleWhen multiple servers are recycling at the same time, (e.g. due to savedchange in SCFG) they'd each call sbbs_read_ini() with a shared global_startupstruct, which in turn calls sbbs_free_ini(), which would free all theallocated network interface
lists (including the global_startup one) usinginiFreeStringList (just a wrapper
for strListFree), but iniFreeStringList()does NOT modify (NULLify) the freed-pointer, so your second or third serverthat called sbbs_read_ini(), with the shared MainForm->global structure, would*again* free the same global interface list. This bug actually has alwaysexisted because get_ini_globals() freed the global interface list in the sameway, except it *immediately* re-allocated a new one by callinginiGetStringList(), so the time window (opportunity) for this race conditionto occur was much smaller. Truly, SBBSCTRL
should use a mutex or othermechanism to protect the shared global_startup struct, but this is a firststep to a full fix: sbbs_free_ini() should (and now does) nullify the freednetwork interface pointers by using strListFree() directly. I haven't beenable to reproduce the crash upon recycle in SBBSCTRL after making this change.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)