Skip to content

Conversation

@michaelortmann
Copy link
Member

Found by: https://github.com/michaelortmann/
Patch by: https://github.com/michaelortmann/
Fixes:

One-line summary:
Fix a pointer in dcc table linking into dcc table. We must not do that because dcc table can be realloced

Additional description (if needed):
Between dns resolve start and finish, realloc can happen here:

dcc = nrealloc(dcc, sizeof(struct dcc_t) * max_dcc);

like when someone connects to the eggdrrop at the right moment
Its a heap-use-after-free
When investigating the code i realized the dns_info.ip pointer is redundant, and the fix equals a cleanup.

Test cases demonstrating functionality (if applicable):

==444524==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0d8c608f58 at pc 0x559353b0b799 bp 0x7ffc6235d370 sp 0x7ffc6235d360
READ of size 4 at 0x7d0d8c608f58 thread T0
    #0 0x559353b0b798 in dns_dcchostbyip /home/michael/projects/eggdrop/src/dns.c:153
[...]
0x7d0d8c608f58 is located 3672 bytes inside of 4560-byte region [0x7d0d8c608100,0x7d0d8c6092d0)
freed by thread T0 here:
    #0 0x7efd8ef1fa45 in realloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:81
    #1 0x559353b3a356 in n_realloc /home/michael/projects/eggdrop/src/mem.c:388
    #2 0x559353afdde4 in increase_socks_max /home/michael/projects/eggdrop/src/dccutil.c:89
[...]
==444524==ABORTING

michaelortmann added a commit to michaelortmann/eggdrop that referenced this pull request Oct 23, 2025
@vanosg vanosg added this to the v1.10.2 milestone Nov 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants