From 932c4e3fd9dcf1eaec1d527f7a1a5cd3eacd886f Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Fri, 7 Aug 2026 16:36:51 +0300
Subject: [PATCH] Fix use-after-free on ftp:// request path in proxychild()

ss pointed into the buf request buffer and was never updated when buf
was realloc()ed while reading request headers (both in the header loop
and in handlehdrfilterscli()). The ftp:// branch then dereferenced the
stale pointer.

Store ss as an offset into buf and recompute it before use.

Requires authenticated access to proxy or configuration with
authentication disabled.

Reported by Calif.io in collaboration with Anthropic
(ref ANT-2026-FHVKZ7VQ).
---
 src/proxy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/proxy.c b/src/proxy.c
index ff90509..2412486 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -247,6 +247,7 @@ void * proxychild(struct clientparam* param) {
  int redirect = 0;
  int prefix = 0, ckeepalive=0;
  int ftp = 0;
+ int ssoff = 0;
 #ifndef ANONYMOUS
  int anonymous;
 #endif
@@ -338,6 +339,7 @@ for(;;){
 
  if ((sb=(unsigned char *)(unsigned char *)strchr((char *)buf, ' ')) == NULL) {RETURN(512);}
  ss = ++sb;
+ ssoff = (int)(ss - buf);
  if(!isconnect) {
 	if (!strncasecmp((char *)sb, "http://", 7)) {
 		sb += 7;
@@ -640,6 +642,7 @@ for(;;){
 	ckeepalive = 1;
 	if(ftpbase) free(ftpbase);
 	ftpbase = NULL;
+	ss = buf + ssoff;
 	if(!(sp = (unsigned char *)strchr((char *)ss, ' '))){RETURN(799);}
 	*sp = 0;