dave/openttd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #11016: Defer deletion of client and server game socket handlers

Browse Source 
This fixes various use after free scenarios in error handling paths
This commit is contained in:
Jonathan G Rennison
2023-06-16 20:54:04 +01:00
committed by PeterN
parent 19ae88fb63
commit 4f6d75f97d
5 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/network/core/tcp_game.cpp
View File

@@ -20,6 +20,8 @@
#include "../../safeguards.h"
static std::vector<std::unique_ptr<NetworkGameSocketHandler>> _deferred_deletions;
/**
* Create a new socket for the game connection.
* @param s The socket to connect with.
@@ -198,3 +200,15 @@ NetworkRecvStatus NetworkGameSocketHandler::Receive_SERVER_MOVE(Packet *p) { ret
NetworkRecvStatus NetworkGameSocketHandler::Receive_CLIENT_MOVE(Packet *p) { return this->ReceiveInvalidPacket(PACKET_CLIENT_MOVE); }
NetworkRecvStatus NetworkGameSocketHandler::Receive_SERVER_COMPANY_UPDATE(Packet *p) { return this->ReceiveInvalidPacket(PACKET_SERVER_COMPANY_UPDATE); }
NetworkRecvStatus NetworkGameSocketHandler::Receive_SERVER_CONFIG_UPDATE(Packet *p) { return this->ReceiveInvalidPacket(PACKET_SERVER_CONFIG_UPDATE); }
void NetworkGameSocketHandler::DeferDeletion()
{
_deferred_deletions.emplace_back(this);
this->is_pending_deletion = true;
}
/* static */ void NetworkGameSocketHandler::ProcessDeferredDeletions()
{
/* Calls deleter on all items */
_deferred_deletions.clear();
}

8
src/network/core/tcp_game.h
View File

@@ -154,7 +154,8 @@ public:
class NetworkGameSocketHandler : public NetworkTCPSocketHandler {
/* TODO: rewrite into a proper class */
private:
NetworkClientInfo *info; ///< Client info related to this socket
NetworkClientInfo *info; ///< Client info related to this socket
bool is_pending_deletion = false; ///< Whether this socket is pending deletion
protected:
NetworkRecvStatus ReceiveInvalidPacket(PacketGameType type);
@@ -543,6 +544,11 @@ public:
const char *ReceiveCommand(Packet *p, CommandPacket *cp);
void SendCommand(Packet *p, const CommandPacket *cp);
bool IsPendingDeletion() const { return this->is_pending_deletion; }
void DeferDeletion();
static void ProcessDeferredDeletions();
};
#endif /* NETWORK_CORE_TCP_GAME_H */