Changeset 242f280

Timestamp:

2016-02-18T11:17:08Z (9 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

0843bbe

Parents:

9456255

Message:

Fix a double free when calling proxy_disconnect() inside phb->func()

Fixes trac ticket #1248

proxy_connected() calls phb->func(), then tries to do phb_free() directly
afterwards, but that might have been freed by a proxy_disconnect() call
during the execution of that callback.

This one happened to several different people because some AIM server
broke recently.

This commit fixes it by implementing a phb_connected() function that
removes the PHB from the hash table before calling phb->func(), which
ensures that any proxy_disconnect() calls just close the fd and nothing
else.

File:

• lib/proxy.c (modified) (5 diffs)

lib/proxy.c

@@ -87 +87 @@
 }
 
+/* calls phb->func safely by ensuring that the phb struct doesn't exist in the
+ * case that proxy_disconnect() is called down there */
+static gboolean phb_connected(struct PHB *phb, gint source)
+{
+        /* save func and data here */
+        b_event_handler func = phb->func;
+        gpointer data = phb->data;
+
+        /* free the struct so that it can't be freed by the callback */
+        phb_free(phb, TRUE);
+
+        /* if any proxy_disconnect() call happens here, it will use the
+         * fd (still open), look it up in the hash table, get NULL, and
+         * proceed to close the fd and do nothing else */
+        func(data, source, B_EV_IO_READ);
+
+        return FALSE;
+}
+
 static gboolean proxy_connected(gpointer data, gint source, b_input_condition cond)
 {
@@ -125 +144 @@
                 phb->proxy_func(phb->proxy_data, source, B_EV_IO_READ);
         } else {
-                phb->func(phb->data, source, B_EV_IO_READ);
-                phb_free(phb, TRUE);
+                phb_connected(phb, source);
         }
 
@@ -222 +240 @@
         if ((memcmp(HTTP_GOODSTRING, inputline, strlen(HTTP_GOODSTRING)) == 0) ||
             (memcmp(HTTP_GOODSTRING2, inputline, strlen(HTTP_GOODSTRING2)) == 0)) {
-                phb->func(phb->data, source, B_EV_IO_READ);
-                return phb_free(phb, TRUE);
+                return phb_connected(phb, source);
         }
 
@@ -295 +312 @@
         memset(packet, 0, sizeof(packet));
         if (read(source, packet, 9) >= 4 && packet[1] == 90) {
-                phb->func(phb->data, source, B_EV_IO_READ);
-                return phb_free(phb, TRUE);
+                return phb_connected(phb, source);
         }
 
@@ -384 +400 @@
         }
 
-        phb->func(phb->data, source, B_EV_IO_READ);
-        return phb_free(phb, TRUE);
+        return phb_connected(phb, source);
 }