| id | BUG-152 | ||||
|---|---|---|---|---|---|
| workflow | local | ||||
| github_issue | |||||
| title | CServerConnect::DestroySocket can leave a freed CServerSocket pointer in the connectionattempts map | ||||
| status | OPEN | ||||
| priority | Major | ||||
| category | bug | ||||
| labels |
|
||||
| milestone | post-0.7.3 | ||||
| created | 2026-06-24 | ||||
| source | crash walking the connectionattempts map (AwaitingTestFromIP / AwaitingConnectionToServer) after a server socket was destroyed via a path that skipped map cleanup |
CServerConnect tracks in-flight connection attempts in the
connectionattempts map (key: timestamp, value: CServerSocket*). Several
socket-destroy paths reach CServerConnect::DestroySocket without first
removing the socket from that map: CServerSocket::OnClose while in
CS_WAITFORLOGIN, and the early-out branch in ConnectionFailed. After
DestroySocket deletes the socket, the map still holds the now-freed
pointer, and the next walk of connectionattempts (in AwaitingTestFromIP
or AwaitingConnectionToServer) dereferences freed memory and crashes.
In DestroySocket, before deleting the socket, scan connectionattempts and
remove any entry whose value equals the socket being destroyed. This makes the
map self-consistent regardless of which destroy path was taken, so it can never
retain a dangling pointer.
File: srchybrid/ServerConnect.cpp (CServerConnect::DestroySocket).