- Fix for the ignore of tcp events for closed comm points, preserve

  the use after free protection features.

diff --git a/doc/Changelog b/doc/Changelog
index 0375b07163f560b75c1de59e1431ac2d14547dcb..17b25f1f8d2d8a5f0547d8f774f536f70fa4282b 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+28 November 2022: Wouter
+       - Fix for the ignore of tcp events for closed comm points, preserve
+         the use after free protection features.
+
 22 November 2022: George
        - Ignore expired error responses.
 

diff --git a/util/netevent.c b/util/netevent.c
index 6ddeb076dd128111265b01e1d6e6216a18d6a287..fe3d511643f8b5de1a789f5244b013cc32f5f6df 100644 (file)
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -2665,6 +2665,7 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 #endif
                ) {
                int has_tcpq = (c->tcp_req_info != NULL);
+               int* moreread = c->tcp_more_read_again;
                if(!comm_point_tcp_handle_read(fd, c, 0)) {
                        reclaim_tcp_handler(c);
                        if(!c->tcp_do_close) {
@@ -2679,12 +2680,13 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
                        if(!tcp_req_info_read_again(fd, c))
                                return;
                }
-               if(c->tcp_more_read_again && *c->tcp_more_read_again)
+               if(moreread && *moreread)
                        tcp_more_read_again(fd, c);
                return;
        }
        if(event&UB_EV_WRITE) {
                int has_tcpq = (c->tcp_req_info != NULL);
+               int* morewrite = c->tcp_more_write_again;
                if(!comm_point_tcp_handle_write(fd, c)) {
                        reclaim_tcp_handler(c);
                        if(!c->tcp_do_close) {
@@ -2699,7 +2701,7 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
                        if(!tcp_req_info_read_again(fd, c))
                                return;
                }
-               if(c->tcp_more_write_again && *c->tcp_more_write_again)
+               if(morewrite && *morewrite)
                        tcp_more_write_again(fd, c);
                return;
        }
@@ -4495,6 +4497,11 @@ comm_point_close(struct comm_point* c)
                tcp_req_info_clear(c->tcp_req_info);
        if(c->h2_session)
                http2_session_server_delete(c->h2_session);
+       /* stop the comm point from reading or writing after it is closed. */
+       if(c->tcp_more_read_again && *c->tcp_more_read_again)
+               *c->tcp_more_read_again = 0;
+       if(c->tcp_more_write_again && *c->tcp_more_write_again)
+               *c->tcp_more_write_again = 0;
 
        /* close fd after removing from event lists, or epoll.. is messed up */
        if(c->fd != -1 && !c->do_not_close) {