konevsa/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: mux-pt: Fix a possible UAF because of traces in mux_pt_io_cb

Browse Source 
In mux_pt_io_cb(), if a connection error or a shutdown is detected, the mux
is destroyed. Thus we must be careful to not use it in a trace message once
destroyed.

No backport needed. This patch should fix the issue #1220.
This commit is contained in:
Christopher Faulet 2021-04-10 09:02:32 +02:00
parent c0ae097b95
commit e2c65ba344
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/mux_pt.c
View File

@ -250,17 +250,16 @@ struct task *mux_pt_io_cb(struct task *t, void *tctx, unsigned int status)
} }
conn_ctrl_drain(ctx->conn); conn_ctrl_drain(ctx->conn);
if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH)) { if (ctx->conn->flags & (CO_FL_ERROR | CO_FL_SOCK_RD_SH | CO_FL_SOCK_WR_SH)) {
TRACE_DEVEL("destroying pt context", PT_EV_CONN_WAKE, ctx->conn); TRACE_DEVEL("leaving destroying pt context", PT_EV_CONN_WAKE, ctx->conn);
mux_pt_destroy(ctx); mux_pt_destroy(ctx);
t = NULL; t = NULL;
} }
else { else {
TRACE_DEVEL("subscribing for reads", PT_EV_CONN_WAKE, ctx->conn);
ctx->conn->xprt->subscribe(ctx->conn, ctx->conn->xprt_ctx, SUB_RETRY_RECV, ctx->conn->xprt->subscribe(ctx->conn, ctx->conn->xprt_ctx, SUB_RETRY_RECV,
&ctx->wait_event); &ctx->wait_event);
TRACE_DEVEL("leaving subscribing for reads", PT_EV_CONN_WAKE, ctx->conn);
} }
TRACE_LEAVE(PT_EV_CONN_WAKE, ctx->conn);
return t; return t;
} }