Hello UGBASE,
For the past few days I've been experimenting with ZombieNet on my test server to track down a crash. I discovered a bug in RakNet (which SA:MP uses): inside RakPeer :: DeallocatePacket it calls delete instead of delete[] when packet->deleteData is true.
This is already fixed in OpenMP, so the issue affects only SA:MP.
void RakPeer::DeallocatePacket( Packet *packet )
{
if ( packet == 0 )
return;
if (packet->deleteData)
delete packet->data; // problem here
free(packet);
}
Somewhere in samp03svr there appears to be a double-free vulnerability.
What does double-free mean?
• If you allocate memory and then free it (via free or delete), that memory is released. If the code later frees the same...