mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

don't close freerdp_peer underlying socket twice

Browse Source 
freerdp_peer->Disconnect calls BIO_free which then calls close on the
underlying file descriptor.

Then when freerdp_peer_free is called, the file descriptor is closed
again.

This is problematic if the file descriptor is recycled in between:

thread 1: freerdp_peer_new(42);
thread 1: freerdp_peer->Disconnect() closes 42
thread 2: opens a file with fd 42
thread 1: freerdp_peer_free closes 42
thread 2: uses closed file descriptor 42
This commit is contained in:
Rubycat 2024-02-09 16:13:32 +01:00 committed by akallabeth
parent 4be2e2db2d
commit 3c2c6cc1d5
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libfreerdp/core/peer.c
View File

@ -1495,6 +1495,7 @@ void freerdp_peer_free(freerdp_peer* client)
return; return;
sspi_FreeAuthIdentity(&client->identity); sspi_FreeAuthIdentity(&client->identity);
if (client->sockfd >= 0)
closesocket((SOCKET)client->sockfd); closesocket((SOCKET)client->sockfd);
free(client); free(client);
} }
@ -1511,6 +1512,7 @@ static BOOL freerdp_peer_transport_setup(freerdp_peer* client)
if (!transport_attach(rdp->transport, client->sockfd)) if (!transport_attach(rdp->transport, client->sockfd))
return FALSE; return FALSE;
client->sockfd = -1;
if (!transport_set_recv_callbacks(rdp->transport, peer_recv_callback, client)) if (!transport_set_recv_callbacks(rdp->transport, peer_recv_callback, client))
return FALSE; return FALSE;