Author: tfaber Date: Wed Aug 10 10:28:28 2016 New Revision: 72183 URL: http://svn.reactos.org/svn/reactos?rev=72183&view=rev Log: [IP] - Only accept an incoming connection on one listening socket, not all. Fixes use after free when multiple connection endpoints are assigned the same PCB. CORE-11649 #resolve
Modified: trunk/reactos/sdk/lib/drivers/ip/transport/tcp/event.c Modified: trunk/reactos/sdk/lib/drivers/ip/transport/tcp/event.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/sdk/lib/drivers/ip/transport/tcp/event.c?rev=72183&r1=72182&r2=72183&view=diff ============================================================================== --- trunk/reactos/sdk/lib/drivers/ip/transport/tcp/event.c [iso-8859-1] (original) +++ trunk/reactos/sdk/lib/drivers/ip/transport/tcp/event.c [iso-8859-1] Wed Aug 10 10:28:28 2016 @@ -345,6 +345,11 @@ DereferenceObject(Bucket->AssociatedEndpoint); CompleteBucket(Connection, Bucket, FALSE); + + if (Status == STATUS_SUCCESS) + { + break; + } } DereferenceObject(Connection);