]> git.ipfire.org Git - thirdparty/rspamd.git/commit
[Fix] hs_helper: fix use-after-free in Redis async cache callbacks
authorVsevolod Stakhov <vsevolod@rspamd.com>
Thu, 29 Jan 2026 15:58:41 +0000 (15:58 +0000)
committerVsevolod Stakhov <vsevolod@rspamd.com>
Thu, 29 Jan 2026 15:58:41 +0000 (15:58 +0000)
commit1799ceac70bd52cfb516b4ff8665c3db983409c5
tree55fa0241f5a2b1fef7413a36a00334968969dcaf
parentc7e6f0ec4545f4fd94adf0c4eea33e02ad6f5583
[Fix] hs_helper: fix use-after-free in Redis async cache callbacks

Remove dangerous ev_run(EVRUN_NOWAIT) calls from inside Redis callback
chains in rspamd_hs_helper_mp_exists_cb and rspamd_hs_helper_remap_exists_cb.

Calling ev_run() inside a callback can trigger Lua GC which may try to
finalize lua_redis userdata while we're still processing the callback,
causing lua_redis_gc to access already-freed memory.

Also add missing REF_RELEASE calls at the end of both callbacks to properly
release the reference from exists_async (matching the exists==true path).
src/hs_helper.c