d3227f1300
Based on error report from JTP in the tbamud forums. If an attacker was able to start a session and then break the connection, the process_output function would fail. This would trigger two calls to close_socket on the same descriptor. This in turn results in a double free on the character struct. https://www.tbamud.com/kunena/4-development/5617-another-core-dump-not-long-after-the-one-earlier Thanks to JTP for the bug report.
Files for tbaMUD.