Ticket #974 (closed Defect: fixed)

Opened 5 years ago

Last modified 5 years ago

Crash on zero size incomming file transfers

Reported by: rexbinary Owned by: timothy
Priority: Highest Milestone:
Component: Chat Core (File Transfer) Version: 2.1 (Mac)
Severity: Critical Keywords: crash file transfer exploit security
Cc:

Description

Colloquy is being crashed on Freenode 2-3 times a day by people spamming file transfer requests with a zero size file. My screen floods with accept/decline messages, then I get a beachball, and then Colloquy crashes. Need to be able to disable file transfers all together or something to work around this exploit.

Attachments

Colloquy.crash.log (23.7 KB) - added by rexbinary 5 years ago.
Colloquy crash log after exploit

Change History

Changed 5 years ago by rexbinary

  • keywords security added

Changed 5 years ago by rexbinary

  • component changed from Colloquy (GUI) to Chat Core (File Transfer)

Changed 5 years ago by rexbinary

  • summary changed from Crash on multiple file transfers to Crash on multiple incomming file transfers

Changed 5 years ago by rexbinary

  • summary changed from Crash on multiple incomming file transfers to Crash on zero size incomming file transfers

I got a single zero size file transfer and it crashed Colloquy. Looks like it's any zero size file transfer will crash Colloquy, not just multiple ones. Updated summery.

Changed 5 years ago by rexbinary

I attached a screenshot of the exploit. If you don't touch the file transfer dialog, Colloquy will continue to work. As soon as you click Refuse on one of the windows, you get a beachball and then Colloquy crashes. I'll attach the crash log as well.

Changed 5 years ago by rexbinary

Colloquy crash log after exploit

Changed 5 years ago by rexbinary

If there was just a way to disable file transfers all together, this would be a great work around while the real fix is addressed.

Changed 5 years ago by timothy

  • status changed from new to assigned

Fixed in [3574].

Changed 5 years ago by rexbinary

Fix confirmed. I received multiple incoming file requests of the same type while running build 3574. I was able to Refuse the connections and did not crash. :)

Changed 5 years ago by Rinoa

  • status changed from assigned to closed
  • resolution set to fixed

Confirmed to be fixed in [3574].

Note: See TracTickets for help on using tickets.