]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()
authorAurelien DARRAGON <adarragon@haproxy.com>
Tue, 1 Apr 2025 09:01:45 +0000 (11:01 +0200)
committerAurelien DARRAGON <adarragon@haproxy.com>
Thu, 3 Apr 2025 15:52:09 +0000 (17:52 +0200)
commitc6fa061f22e0409a9c1e0dbe9d4bd9a30eff6ba1
tree930f122657bd3309afd66e328762d05efb1bc9ef
parentb77b1a2c3ac70a719a2a06964e56a206ab9cc6ec
BUG/MINOR: hlua_fcn: fix potential UAF with Queue:pop_wait()

If Queue:pop_wait() excecuted from a stream context and pop_wait() is
aborted due to a Lua or ressource error, then the waiting object pointing
to the task will still be registered, so if the task eventually dissapears,
Queue:push() may try to wake invalid task pointer..

To prevent this bug from happening, we now rely on notification_* API to
deliver waiting signals. This way signals are properly garbage collected
when a lua context is destroyed.

It should be backported in 2.8 with 86fb22c55 ("MINOR: hlua_fcn: add Queue
class").
This patch depends on ("MINOR: task: add thread safe notification_new and
notification_wake variants")
src/hlua_fcn.c