| tiêu đề | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 Double Free |
|---|
| Mô tả | double-free on the receive error path
Location: src/afc.c:314-328
err = ...service_receive(client->parent, buf, this_len, &recv_len);
if (err != AFC_E_SUCCESS) {
free(buf); // 1st free
debug_info(...);
}
if (recv_len <= 0) { // recv_len was NEVER updated on error
free(buf); // 2nd free -> double free
...
}
Root cause. On service_receive failure the code frees buf but does not return. service_receive_with_timeout leaves recv_len at 0 on error (it only writes *received on success), so the recv_len <= 0 branch runs and frees again.
Trigger (peer): send a valid OP_DATA reply header, then reset the connection (SO_LINGER=0) instead of the body. The body recv fails with ECONNRESET, recv_len stays 0 → double free.
Impact. Double-free / UAF in the host process → glibc abort (free(): double free detected in tcache 2, exit 134); under ASAN a reliable crash.
Expected output: victim exit=134 with free(): double free detected. |
|---|
| Nguồn | ⚠️ https://bohmid-com.vercel.app/#/article/blog-afc-writeup |
|---|
| Người dùng | ahmed0000 (UID 51651) |
|---|
| Đệ trình | 01/10/2026 17:22 (cách đây 26 ngày) |
|---|
| Kiểm duyệt | 25/10/2026 18:44 (24 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 426299 [libimobiledevice đến 1.4.0 AFC Service src/afc.c service_receive tràn bộ đệm] |
|---|
| điểm | 20 |
|---|