Double Free on Cloudflare

Cloudflare’s platform exposes a variety of APIs that are implemented in performance‑critical C/C++ components (e.g., the custom rules engine, rate‑limiting token bucket library, and TLS ticket handling). When these components allocate objects for incoming requests, they sometimes follow a pattern where an error path releases a resource and then, due to duplicated error‑handling logic, attempts to release the same pointer a second time.

Consider a simplified snippet that mirrors the logic used in Cloudflare’s custom rule validation endpoint (/client/v4/zones/:zone_id/firewall/rules). The function parses a JSON payload, allocates a cf_rule_t structure, validates fields, and on any validation failure frees the structure and returns an error. If two separate validation checks both fail, the same pointer can be freed twice.

/* Simplified Cloudflare rule‑creation handler */
cf_rule_t* create_rule(const json_t* payload) {
    cf_rule_t* rule = cf_malloc(sizeof(cf_rule_t));
    if (!rule) return NULL;
    rule->action = NULL;
    rule->expression = NULL;

    /* Validate action */
    if (!json_is_string(json_object_get(payload, "action"))) {
        cf_free(rule);   /* first free */
        return NULL;
    }
    rule->action = strdup(json_string_value(json_object_get(payload, "action")));

    /* Validate expression */
    if (!json_is_string(json_object_get(payload, "expression"))) {
        cf_free(rule->action);
        cf_free(rule);   /* second free if action was already freed above */
        return NULL;
    }
    rule->expression = strdup(json_string_value(json_object_get(payload, "expression")));
    return rule;
}

If the action field is missing, the function frees rule and returns. The caller, unaware of the failure, may still invoke a cleanup routine that again calls cf_free(rule) on the already‑freed pointer, resulting in a double free. In Cloudflare’s production code, similar patterns appear in the TLS ticket encryption module and the rate‑limiting token bucket library, where error handling for malformed JSON or missing headers duplicates the free operation.

Exploitation of a double free can lead to heap corruption, arbitrary code execution, or denial‑of‑service, especially when the allocator’s metadata is overwritten. Attackers craft requests that trigger the error path (e.g., omitting required fields) and then send a follow‑up request that influences the freed memory layout, allowing them to gain control over subsequent allocations.

middleBrick does not require agents or credentials; it scans the unauthenticated attack surface by sending crafted HTTP requests to the target API and analysing responses for signs of memory‑corruption bugs. For a double free, the scanner looks for:

• Consistent 500/502 errors when specific fields are omitted or contain malformed data.
• Variations in response length or timing that indicate internal state changes (e.g., a second request after the first triggers a different error code).
• Presence of error messages that reference internal allocators (e.g., "free(): invalid pointer" or "double free or corruption") in the response body or headers.

To detect this class of issue on a Cloudflare‑hosted API, you can run middleBrick from the CLI:

middlebrick scan https://api.example.com/client/v4/zones/12345/firewall/rules \
    --header "Content-Type: application/json" \
    --data-raw '{}'   \
    --fail-under C   \
    --output json