Opened 11 years ago

Closed 11 years ago

#974 closed Defect (Fixed)

Crash on zero size incomming file transfers

Reported by: rexbinary Owned by: timothy
Component: Chat Core (IRC) Version: 2.1 (Mac)
Severity: Critical Keywords: crash file transfer exploit security
Cc:

Description

Colloquy is being crashed on Freenode 2-3 times a day by people spamming file transfer requests with a zero size file. My screen floods with accept/decline messages, then I get a beachball, and then Colloquy crashes. Need to be able to disable file transfers all together or something to work around this exploit.

Change History (9)

comment:1 Changed 11 years ago by rexbinary

  • Keywords security added

comment:2 Changed 11 years ago by rexbinary

  • Component changed from Colloquy (GUI) to Chat Core (File Transfer)

comment:3 Changed 11 years ago by rexbinary

  • Summary changed from Crash on multiple file transfers to Crash on multiple incomming file transfers

comment:4 Changed 11 years ago by rexbinary

  • Summary changed from Crash on multiple incomming file transfers to Crash on zero size incomming file transfers

I got a single zero size file transfer and it crashed Colloquy. Looks like it's any zero size file transfer will crash Colloquy, not just multiple ones. Updated summery.

comment:5 Changed 11 years ago by rexbinary

I attached a screenshot of the exploit. If you don't touch the file transfer dialog, Colloquy will continue to work. As soon as you click Refuse on one of the windows, you get a beachball and then Colloquy crashes. I'll attach the crash log as well.

comment:6 Changed 11 years ago by rexbinary

If there was just a way to disable file transfers all together, this would be a great work around while the real fix is addressed.

comment:7 Changed 11 years ago by timothy

  • Status changed from new to assigned

Fixed in [3574].

comment:8 Changed 11 years ago by rexbinary

Fix confirmed. I received multiple incoming file requests of the same type while running build 3574. I was able to Refuse the connections and did not crash. :)

comment:9 Changed 11 years ago by Rinoa

  • Resolution set to fixed
  • Status changed from assigned to closed

Confirmed to be fixed in [3574].

Note: See TracTickets for help on using tickets.