From: Alex Rousskov <rousskov@measurement-factory.com>
Date: Thu, 6 Oct 2016 22:05:50 +0000 (-0600)
Subject: Fix known "concurrent c_str()s" violations of SBuf API.
X-Git-Tag: SQUID_4_0_15~5
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=81e019a0db76b61682f57ca88a6109c9da0c75a7;p=thirdparty%2Fsquid.git

Fix known "concurrent c_str()s" violations of SBuf API.

The second c_str() call destroys the buffer still being used by the
first c_str() result, leading to many "Invalid read of size N" errors.

IMO, we must instead fix SBuf to make similar violations unlikely, but
there is currently no squid-dev consensus on whether and how to do that.
See "[RFC] Support concurrent SBuf::c_str() calls" thread on squid-dev.
---

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index a94b61f117..d6cfc7eb62 100644
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -1787,8 +1787,9 @@ ClientHttpRequest::doCallouts()
 
     if (calloutContext->error) {
         // XXX: prformance regression. c_str() reallocates
-        SBuf storeUri(request->storeId());
-        StoreEntry *e = storeCreateEntry(storeUri.c_str(), storeUri.c_str(), request->flags, request->method);
+        SBuf storeUriBuf(request->storeId());
+        const char *storeUri = storeUriBuf.c_str();
+        StoreEntry *e = storeCreateEntry(storeUri, storeUri, request->flags, request->method);
 #if USE_OPENSSL
         if (sslBumpNeeded()) {
             // We have to serve an error, so bump the client first.
diff --git a/src/ssl/ServerBump.cc b/src/ssl/ServerBump.cc
index c16dbdb8d9..5de903eae1 100644
--- a/src/ssl/ServerBump.cc
+++ b/src/ssl/ServerBump.cc
@@ -33,8 +33,9 @@ Ssl::ServerBump::ServerBump(HttpRequest *fakeRequest, StoreEntry *e, Ssl::BumpMo
         entry->lock("Ssl::ServerBump");
     } else {
         // XXX: Performance regression. c_str() reallocates
-        SBuf uri(request->effectiveRequestUri());
-        entry = storeCreateEntry(uri.c_str(), uri.c_str(), request->flags, request->method);
+        SBuf uriBuf(request->effectiveRequestUri());
+        const char *uri = uriBuf.c_str();
+        entry = storeCreateEntry(uri, uri, request->flags, request->method);
     }
     // We do not need to be a client because the error contents will be used
     // later, but an entry without any client will trim all its contents away.