bughz/3proxy
1
0
Fork 0
mirror of https://github.com/3proxy/3proxy.git synced 2026-08-13 12:19:17 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Fix use-after-free on ftp:// request path in proxychild()

Browse Source 
ss pointed into the buf request buffer and was never updated when buf
was realloc()ed while reading request headers (both in the header loop
and in handlehdrfilterscli()). The ftp:// branch then dereferenced the
stale pointer.

Store ss as an offset into buf and recompute it before use.

Requires authenticated access to proxy or configuration with
authentication disabled.

Reported by Calif.io in collaboration with Anthropic
(ref ANT-2026-FHVKZ7VQ).
This commit is contained in:
Vladimir Dubrovin 2026-08-07 16:36:51 +03:00
parent 6818872f63
commit 932c4e3fd9
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/proxy.c
View File

@ -247,6 +247,7 @@ void * proxychild(struct clientparam* param) {
int redirect = 0; int redirect = 0;
int prefix = 0, ckeepalive=0; int prefix = 0, ckeepalive=0;
int ftp = 0; int ftp = 0;
int ssoff = 0;
#ifndef ANONYMOUS #ifndef ANONYMOUS
int anonymous; int anonymous;
#endif #endif
@ -338,6 +339,7 @@ for(;;){
if ((sb=(unsigned char *)(unsigned char *)strchr((char *)buf, ' ')) == NULL) {RETURN(512);} if ((sb=(unsigned char *)(unsigned char *)strchr((char *)buf, ' ')) == NULL) {RETURN(512);}
ss = ++sb; ss = ++sb;
ssoff = (int)(ss - buf);
if(!isconnect) { if(!isconnect) {
if (!strncasecmp((char *)sb, "http://", 7)) { if (!strncasecmp((char *)sb, "http://", 7)) {
sb += 7; sb += 7;
@ -640,6 +642,7 @@ for(;;){
ckeepalive = 1; ckeepalive = 1;
if(ftpbase) free(ftpbase); if(ftpbase) free(ftpbase);
ftpbase = NULL; ftpbase = NULL;
ss = buf + ssoff;
if(!(sp = (unsigned char *)strchr((char *)ss, ' '))){RETURN(799);} if(!(sp = (unsigned char *)strchr((char *)ss, ' '))){RETURN(799);}
*sp = 0; *sp = 0;