urbit/shrub
1
1
Fork 0
mirror of https://github.com/urbit/shrub.git synced 2024-12-01 06:35:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

vere: fix use-after-free in closing/canceling http request

Browse Source
This commit is contained in:
Joe Bryan 2019-12-14 18:02:50 -08:00
parent d5949f2358
commit 01470355d1
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/urbit/vere/http.c
View File

@ -325,9 +325,9 @@ _http_req_done(void* ptr_v)
{ {
u3_hreq* req_u = (u3_hreq*)ptr_v; u3_hreq* req_u = (u3_hreq*)ptr_v;
// client canceled request // client canceled request before response
if ( (u3_rsat_plan == req_u->sat_e ) || //
(0 != req_u->gen_u && c3n == ((u3_hgen*)req_u->gen_u)->dun )) { if ( u3_rsat_plan == req_u->sat_e ) {
_http_req_kill(req_u); _http_req_kill(req_u);
} }
@ -461,7 +461,13 @@ _http_hgen_send(u3_hgen* gen_u)
static void static void
_http_hgen_stop(h2o_generator_t* neg_u, h2o_req_t* rec_u) _http_hgen_stop(h2o_generator_t* neg_u, h2o_req_t* rec_u)
{ {
// kill request in %light u3_hgen* gen_u = (u3_hgen*)neg_u;
// response not complete, enqueue cancel
//
if ( c3n == gen_u->dun ) {
_http_req_kill(gen_u->req_u);
}
} }
/* _http_hgen_proceed(): h2o is ready for more response data. /* _http_hgen_proceed(): h2o is ready for more response data.