[gnutls] fix cleanup order (use-after-free)

personal/stbuehler/wip
Stefan Bühler 9 years ago
parent 45aeb29703
commit f3436e69f1
  1. 8
      include/lighttpd/stream.h
  2. 9
      src/modules/mod_gnutls.c

@ -87,6 +87,7 @@ LI_API const gchar* li_iostream_event_string(liIOStreamEvent event);
LI_API liIOStream* li_iostream_new(liWorker *wrk, int fd, liIOStreamCB cb, gpointer data);
LI_API void li_iostream_acquire(liIOStream* iostream);
LI_API void li_iostream_release(liIOStream* iostream);
INLINE void li_iostream_safe_release(liIOStream** piostream);
LI_API int li_iostream_reset(liIOStream *iostream); /* returns fd, disconnects everything, stop callbacks, releases one reference */
@ -122,4 +123,11 @@ INLINE void li_stream_safe_reset_and_release(liStream** pstream) {
li_stream_release(stream);
}
INLINE void li_iostream_safe_release(liIOStream** piostream) {
liIOStream *iostream;
if (NULL == piostream || NULL == (iostream = *piostream)) return;
*piostream = NULL;
li_iostream_release(iostream);
}
#endif

@ -324,12 +324,6 @@ static void close_cb(liGnuTLSFilter *f, gpointer data) {
li_stream_release(raw_in);
}
if (NULL != conctx->sock_stream) {
liIOStream *stream = conctx->sock_stream;
conctx->sock_stream = NULL;
li_iostream_release(stream);
}
#ifdef USE_SNI
if (NULL != conctx->sni_db_wait) {
li_fetch_cancel(&conctx->sni_db_wait);
@ -355,6 +349,9 @@ static void close_cb(liGnuTLSFilter *f, gpointer data) {
conctx->sni_server_name = NULL;
}
#endif
assert(NULL != conctx->sock_stream);
li_iostream_safe_release(&conctx->sock_stream);
}
static int post_client_hello_cb(liGnuTLSFilter *f, gpointer data) {

Loading…
Cancel
Save