cuberite/libevent
1
0
Fork 0
mirror of https://github.com/cuberite/libevent.git synced 2025-09-11 13:24:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix incorrect assertions and possible use-after-free in evrpc_free()

Browse Source 
Original description:

  The following patch fixes incorrect assertions in evrpc_free():
  evrpc_unregister_rpc() and evrpc_remove_hook() return 0 for success.

  Also, in evrpc_unregister_rpc(), it is better to free RPC structure
  at the end: evrpc_free() uses rpc->uri as "name" parameter when
  calling evrpc_unregister_rpc(), then rpc->uri is freed, but we have
  "registered_uri = evrpc_construct_uri(name)". So at this time "name"
  is invalid.
This commit is contained in:
Christophe Fillot 2011-03-12 12:08:19 -05:00 committed by Nick Mathewson
parent 5209fadfd0
commit 4b8f02f147
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
evrpc.c
View File

@ -98,7 +98,7 @@ evrpc_free(struct evrpc_base *base)
while ((rpc = TAILQ_FIRST(&base->registered_rpcs)) != NULL) { while ((rpc = TAILQ_FIRST(&base->registered_rpcs)) != NULL) {
r = evrpc_unregister_rpc(base, rpc->uri); r = evrpc_unregister_rpc(base, rpc->uri);
EVUTIL_ASSERT(r); EVUTIL_ASSERT(r == 0);
} }
while ((pause = TAILQ_FIRST(&base->paused_requests)) != NULL) { while ((pause = TAILQ_FIRST(&base->paused_requests)) != NULL) {
TAILQ_REMOVE(&base->paused_requests, pause, next); TAILQ_REMOVE(&base->paused_requests, pause, next);
@ -263,9 +263,6 @@ evrpc_unregister_rpc(struct evrpc_base *base, const char *name)
} }
TAILQ_REMOVE(&base->registered_rpcs, rpc, next); TAILQ_REMOVE(&base->registered_rpcs, rpc, next);
mm_free((char *)rpc->uri);
mm_free(rpc);
registered_uri = evrpc_construct_uri(name); registered_uri = evrpc_construct_uri(name);
/* remove the http server callback */ /* remove the http server callback */
@ -273,6 +270,9 @@ evrpc_unregister_rpc(struct evrpc_base *base, const char *name)
EVUTIL_ASSERT(r == 0); EVUTIL_ASSERT(r == 0);
mm_free(registered_uri); mm_free(registered_uri);
mm_free((char *)rpc->uri);
mm_free(rpc);
return (0); return (0);
} }