User after Free in zftp module

User after Free in zftp module

[Hamidreza]

[-- Attachment #1: Type: text/plain, Size: 292 bytes --]

Hello,

There is a security vulnerablity in zftp module.
At `
https://github.com/zsh-users/zsh/blob/acdcf9d8542a4461c0fceb98fdfef7380a128f78/Src/Modules/zftp.c#L3149`,
`zfsessions` is begin freed but the variable is not set to NULL afterwards
which leads to a "Use after Free" bug.

Regards,

[-- Attachment #2: Type: text/html, Size: 502 bytes --]

Re: User after Free in zftp module

[Peter Stephenson]

> On 10/05/2024 09:26 BST Hamidreza <0xxparrot1@gmail.com> wrote:
> There is a security vulnerablity in zftp module.
>
> At
> `https://github.com/zsh-users/zsh/blob/acdcf9d8542a4461c0fceb98fdfef7380a128f78/Src/Modules/zftp.c#L3149`,
> `zfsessions` is begin freed but the variable is not set to NULL
> afterwards which leads to a "Use after Free" bug.

Thanks, that's clear.

pws

diff --git a/Src/Modules/zftp.c b/Src/Modules/zftp.c
index 0c26828..b60e5bf 100644
--- a/Src/Modules/zftp.c
+++ b/Src/Modules/zftp.c
@@ -3147,6 +3147,7 @@ zftp_cleanup(void)
     lastmsg = NULL;
     zfunsetparam("ZFTP_SESSION");
     freelinklist(zfsessions, (FreeFunc) freesession);
+    zfsessions = NULL;
     zfree(zfstatusp, sizeof(int)*zfsesscnt);
     zfstatusp = NULL;
 }