From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Thu, 9 Oct 2025 09:06:22 +0000 (+0100)
Subject: [Fix] Fix refcount leak in fuzzy_session destructor for TCP sessions
X-Git-Tag: 3.14.0~84^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7e6dd0b98259200a4719766ef5101ed52b694826;p=thirdparty%2Frspamd.git

[Fix] Fix refcount leak in fuzzy_session destructor for TCP sessions

The fuzzy_session created for TCP command processing holds a reference
to its parent fuzzy_tcp_session but failed to release it in the destructor,
causing a refcount leak and potential use-after-free issue.
---

diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index d0edcca81a..fcd8987dde 100644
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -2327,6 +2327,10 @@ fuzzy_session_destroy(gpointer d)
 	if (session->tcp_session == NULL) {
 		session->worker->nconns--;
 	}
+	else {
+		/* Release the reference to the TCP session */
+		REF_RELEASE(session->tcp_session);
+	}
 
 	if (session->ip_stat) {
 		REF_RELEASE(session->ip_stat);