From 0353d313554e92467d2e13931af7fbeb6f517eba Mon Sep 17 00:00:00 2001 From: "jabber.developer2" Date: Thu, 25 Dec 2025 23:04:13 +0300 Subject: [PATCH] Fix race condition in log_println (use-after-free) The check for logready was done BEFORE acquiring the lock, causing a race condition with log_close(). If log_close() runs between the check and the lock acquisition, the log file would be closed but log_println would still try to write to it (use-after-free). Now the logready/logp check is inside the critical section. --- src/server/log.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/server/log.c b/src/server/log.c index 8b017a6..3f7f6c9 100644 --- a/src/server/log.c +++ b/src/server/log.c @@ -70,11 +70,14 @@ log_init(stbbr_log_t loglevel) void log_println(stbbr_log_t loglevel, const char * const msg, ...) { - if (!logready || loglevel < minlevel) { + pthread_mutex_lock(&loglock); + + // Check logready AFTER acquiring lock to prevent race with log_close + if (!logready || !logp || loglevel < minlevel) { + pthread_mutex_unlock(&loglock); return; } - pthread_mutex_lock(&loglock); va_list arg; va_start(arg, msg); GString *fmt_msg = g_string_new(NULL);