From 0439f525d3b411f1500989f48145def040d1acad Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Wed, 10 Aug 2016 10:28:28 +0000 Subject: [PATCH] [IP] - Only accept an incoming connection on one listening socket, not all. Fixes use after free when multiple connection endpoints are assigned the same PCB. CORE-11649 #resolve svn path=/trunk/; revision=72183 --- reactos/sdk/lib/drivers/ip/transport/tcp/event.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/reactos/sdk/lib/drivers/ip/transport/tcp/event.c b/reactos/sdk/lib/drivers/ip/transport/tcp/event.c index 8c335182a93..1d9918c821f 100644 --- a/reactos/sdk/lib/drivers/ip/transport/tcp/event.c +++ b/reactos/sdk/lib/drivers/ip/transport/tcp/event.c @@ -345,6 +345,11 @@ TCPAcceptEventHandler(void *arg, PTCP_PCB newpcb) DereferenceObject(Bucket->AssociatedEndpoint); CompleteBucket(Connection, Bucket, FALSE); + + if (Status == STATUS_SUCCESS) + { + break; + } } DereferenceObject(Connection); -- 2.17.1