From 3932697b0d4c9ca01e6d1d2ae84e7f386389e099 Mon Sep 17 00:00:00 2001
From: Thanos Doukoudakis <thanos.doukoudakis@isode.com>
Date: Thu, 4 May 2017 18:55:18 +0100
Subject: Fix SendFile example heap-use-after-free

This fixes the crash by moving Swift::Client to a unique_ptr.
By specifying the order the objects will be destructed, we avoid
accessing the Socks5ByteStreamProxiesManager instance after it has
been destroyed. Also there is no need reset the outgoingFileTransfer
pointer.

Test Information:
Use the SendFile example to send a file to a user connected with Swift.

Change-Id: I0462dc60c1d4d5eb3b07516c6e609bbe70954039

diff --git a/Swiften/Examples/SendFile/SendFile.cpp b/Swiften/Examples/SendFile/SendFile.cpp
index 0e1fb23..2b701c7 100644
--- a/Swiften/Examples/SendFile/SendFile.cpp
+++ b/Swiften/Examples/SendFile/SendFile.cpp
@@ -39,8 +39,7 @@ static int exitCode = 2;
 
 class FileSender {
     public:
-    FileSender(const JID& jid, const std::string& password, const JID& recipient, const boost::filesystem::path& file) : jid(jid), password(password), recipient(recipient), file(file), tracer(nullptr) {
-            client = new Swift::Client(jid, password, &networkFactories);
+    FileSender(const JID& jid, const std::string& password, const JID& recipient, const boost::filesystem::path& file) : jid(jid), password(password), recipient(recipient), file(file), tracer(nullptr), client(std::unique_ptr<Swift::Client>(new Swift::Client(jid, password, &networkFactories))) {
             client->onConnected.connect(boost::bind(&FileSender::handleConnected, this));
             client->onDisconnected.connect(boost::bind(&FileSender::handleDisconnected, this, _1));
             //tracer = new ClientXMLTracer(client);
@@ -51,7 +50,6 @@ class FileSender {
             delete tracer;
             client->onDisconnected.disconnect(boost::bind(&FileSender::handleDisconnected, this, _1));
             client->onConnected.disconnect(boost::bind(&FileSender::handleConnected, this));
-            delete client;
         }
 
         void start() {
@@ -95,7 +93,6 @@ class FileSender {
 
         void handleFileTransferFinished(const boost::optional<FileTransferError>& error) {
             std::cout << "File transfer finished." << std::endl;
-            outgoingFileTransfer.reset();
             if (error) {
                 client->disconnect();
                 exit(-1);
@@ -118,8 +115,8 @@ class FileSender {
         std::string password;
         JID recipient;
         boost::filesystem::path file;
-        Client* client;
         ClientXMLTracer* tracer;
+        std::unique_ptr<Swift::Client> client;
 };
 
 
-- 
cgit v0.10.2-6-g49f6