[Fix] Fix double-release of fuzzy_tcp_session on invalid commands

When a TCP command fails to parse in rspamd_fuzzy_tcp_io, the
fuzzy_tcp_session was released prematurely while cmd_session still
held a reference to it. This caused a double-release when cmd_session
was destroyed, potentially leading to memory corruption.

diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index fcd8987dded6705c4a2e1c1510eecee00a54a232..efd28dd47c54014d652da208becef8c0949ba407 100644 (file)
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -2740,7 +2740,7 @@ rspamd_fuzzy_tcp_io(EV_P_ ev_io *w, int revents)
                                        msg_debug_fuzzy_storage("invalid TCP fuzzy command of size %d received from %s",
                                                                                        (int) frame_len,
                                                                                        rspamd_inet_address_to_string(session->common.addr));
-                                       REF_RELEASE(session); /* Release TCP session reference */
+                                       /* Note: Don't release session here - cmd_session holds a reference and will release it */
                                }
 
                                /* Release our reference - session will be freed when all callbacks complete */