Re: [RFC] Resouce leak/Denial of service in bb_boxc.c

> I think some code is needed in boxc_receive() to cater for this; ie.
> 
>         msg = read_from_box(conn);
> 
>         if (msg == NULL) {      /* garbage/connection lost */
>             conn->alive = 0;
>                 if (conn -> boxc_id == NULL)
>                 mutex_unlock(conn->boxc_id_mutex);
>             break;
>         }
> 
> so if the boxc_id is NULL, no cmd_identity message has been received and the
> corresponding boxc_sender() thread is still blocked on the
> conn->boxc_id_mutex
> mutex.

nop, this won't work. Because smsbox client *may* connect without
explicite ID and hence conn->boxc_id would be left == NULL.

So when a smsbox connection breaks, and the smsbox was not having an
smsbox-id then the mutex is tried to unlock and crash:

2003-08-25 11:45:05 [10] ERROR: Connection to box <127.0.0.1> broke.
2003-08-25 11:45:05 [10] PANIC: gwlib/thread.c:100: mutex_unlock_real:
Mutex failure! (Called from gw/bb_boxc.
c:199:boxc_receiver.)

Stipe

[email protected]
-------------------------------------------------------------------
Wapme Systems AG

Vogelsanger Weg 80
40470 Düsseldorf

Tel: +49-211-74845-0
Fax: +49-211-74845-299

E-Mail: [email protected]
Internet: http://www.wapme-systems.de
-------------------------------------------------------------------
wapme.net - wherever you are