fixing qrashTox vulnerability

[3907-bh]

Any Tox user can put a victim's qTox client into a state where it segfaults, by sending two or more friend requests. Once the victim accepts or rejects one of the requests, qTox keeps a dangling pointer to a destroyed Accept button. The next time the interface retranslates (the victim changes the display language, or edits their own username), qTox writes through that stale pointer and crashes. The crash is a use-after-free read and write (CWE-416), verified with a debugger backtrace and core dumps. The same primitive is a candidate for controlled exploitation with heap grooming, although this report demonstrates denial of service only.

read https://github.com/3907-bh/qrashTox

---

This change is 

[github-actions]

Warning

Build failed. Please check the logs.

[Green-Sky]

It looks like you based your commit on qtox/qtox, not toktok/qtox.

[3907-bh]

i did, but the same code is present here so i presume the same vulnerability is present

[Green-Sky]

Also potential security issues should have been reported through the appropriate channels like https://github.com/TokTok/qTox/security/advisories/new .

Though I have to admit that the SECURITY.md is outdated.

[Green-Sky]

i did, but the same code is present here so i presume the same vulnerability is present

Yes, but that still means you have to fix your git history and rebase onto toktok/qtox master.

[3907-bh]

yeaaaa, i do agree. my apologies. however, i also forgot about TokTok's version after looking at the official qTox/qTox, then realised this exists, and just thought it be quicker. again, apologies

[3907-bh]

i did, but the same code is present here so i presume the same vulnerability is present

Yes, but that still means you have to fix your git history and rebase onto toktok/qtox master.

verify the changes i've made are correct, please. i did what was asked

[Green-Sky]

PR title and commit messages require a certain format, check the Mergable ci job.
Also we require commits to be signed by the author.