Fix segmentation fault inside Adaptation::Icap::Xaction::swanSong

The Adaptation::Icap::Xaction::swanSong may try to use an invalid
Icap::Xaction::cs object (Comm::ConnOpener object) if the  Comm::ConnOpener
is already gone (because its job finished) but the  Xaction::noteCommConnected
method is not called yet.

This patch makes the Adaptation::Icap::Xaction::cs object a CbcPointer instead
of a raw pointer and checks if the Xaction::cs object is still valid before
using it.

This is a Measurement Factory project

diff --git a/src/adaptation/icap/Xaction.cc b/src/adaptation/icap/Xaction.cc
index fd76fdbe828ee2d33101099c5a5d9eb5e08c7714..81a37a8ffe663028a71ba6222fcb5d985fd25f27 100644 (file)
--- a/src/adaptation/icap/Xaction.cc
+++ b/src/adaptation/icap/Xaction.cc
@@ -184,7 +184,7 @@ Adaptation::Icap::Xaction::dnsLookupDone(const ipcache_addrs *ia)
     connector = JobCallback(93,3, ConnectDialer, this, Adaptation::Icap::Xaction::noteCommConnected);
     cs = new Comm::ConnOpener(connection, connector, TheConfig.connect_timeout(service().cfg().bypass));
     cs->setHost(s.cfg().host.termedBuf());
-    AsyncJob::Start(cs);
+    AsyncJob::Start(cs.get());
 }
 
 /*
@@ -522,7 +522,7 @@ void Adaptation::Icap::Xaction::setOutcome(const Adaptation::Icap::XactOutcome &
 void Adaptation::Icap::Xaction::swanSong()
 {
     // kids should sing first and then call the parent method.
-    if (cs) {
+    if (cs.valid()) {
         debugs(93,6, HERE << id << " about to notify ConnOpener!");
         CallJobHere(93, 3, cs, Comm::ConnOpener, noteAbort);
         cs = NULL;

diff --git a/src/adaptation/icap/Xaction.h b/src/adaptation/icap/Xaction.h
index 4a9000ea90dbe9cc7ab5386814ed75b5f870bc9a..5379f5ae633c4f829703593de4af3970b009e10c 100644 (file)
--- a/src/adaptation/icap/Xaction.h
+++ b/src/adaptation/icap/Xaction.h
@@ -12,8 +12,7 @@
 #include "AccessLogEntry.h"
 #include "adaptation/icap/ServiceRep.h"
 #include "adaptation/Initiate.h"
-#include "comm/forward.h"
-#include "CommCalls.h"
+#include "comm/ConnOpener.h"
 #include "HttpReply.h"
 #include "ipcache.h"
 #include "MemBuf.h"
@@ -163,8 +162,7 @@ protected:
     timeval icap_tio_finish;   /*time when the last byte of the ICAP responsewas received*/
 
 private:
-    Comm::ConnOpener *cs;
-    //CBDATA_CLASS2(Xaction);
+    Comm::ConnOpener::Pointer cs;
 };
 
 } // namespace Icap