virtualsquare/picotcp

Double Free Issue Report

Closed this issue · 3 comments

GANGE666 commented

I found a security issue in picoTCP v1.7.0 and picoTCP-NG v2.1. It's a double free bug in function pico_fragments_reassemble (Line 362 and Line 364 in modules/pico_fragments.c ).

In function pico_transport_receive, when the switch goes into a default branch, it would release f (Line 239 in stack/pico_stack.c) and return -1. However, after -1 have been return from pico_transport_receive(full, proto) (Line 362 in modules/pico_fragments.c), another pico_frame_discard(full)(Line 364 in modules/pico_fragments.c) would be called and pico_frame_discard release full again. This leads a double free bug.

danielinux commented

Thanks for reporting @GANGE666 ! A PR has been submitted.

danielinux commented

PR merged. Closing...

liu-yichen-github commented

Could you provide an example that triggered this issue，Thank You.