From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Tue, 7 Apr 2020 17:15:53 +0000 (-0500)
Subject: rlm_radius: More asserts
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7848e5c73d20bdb4209dfefe316189ec99a6662d;p=thirdparty%2Ffreeradius-server.git

rlm_radius: More asserts
---

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index da56a960699..08b959c8f44 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -1669,6 +1669,9 @@ static void request_mux(fr_event_list_t *el,
 		 */
 		if (!treq) break;
 
+ 		rad_assert((treq->state == FR_TRUNK_REQUEST_STATE_PENDING) ||
+			   (treq->state == FR_TRUNK_REQUEST_STATE_PARTIAL));
+
 		request = treq->request;
 		u = talloc_get_type_abort(treq->preq, udp_request_t);
 
@@ -1745,6 +1748,11 @@ static void request_mux(fr_event_list_t *el,
 	queued = i;
 	if (queued == 0) return;	/* No work */
 
+	/*
+	 *	Verify nothing accidentally freed the connection handle
+	 */
+	(void)talloc_get_type_abort(h, udp_handle_t);
+
 	/*
 	 *	Send the coalesced datagrams
 	 */
@@ -1811,6 +1819,8 @@ static void request_mux(fr_event_list_t *el,
 		 */
 		rad_assert((size_t)h->mmsgvec[i].msg_len == h->mmsgvec[i].msg_hdr.msg_iov->iov_len);
 
+		rad_assert(treq->state == FR_TRUNK_REQUEST_STATE_SENT);
+
 		request = treq->request;
 		u = talloc_get_type_abort(treq->preq, udp_request_t);
 
@@ -1882,6 +1892,9 @@ static void request_mux_replicate(UNUSED fr_event_list_t *el,
 		 */
 		if (!treq) break;
 
+ 		rad_assert((treq->state == FR_TRUNK_REQUEST_STATE_PENDING) ||
+			   (treq->state == FR_TRUNK_REQUEST_STATE_PARTIAL));
+
 		request = treq->request;
 		u = talloc_get_type_abort(treq->preq, udp_request_t);
 
@@ -1908,6 +1921,11 @@ static void request_mux_replicate(UNUSED fr_event_list_t *el,
 	queued = i;
 	if (queued == 0) return;	/* No work */
 
+	/*
+	 *	Verify nothing accidentally freed the connection handle
+	 */
+	(void)talloc_get_type_abort(h, udp_handle_t);
+
 	sent = sendmmsg(h->fd, h->mmsgvec, queued, 0);
 	if (sent < 0) {		/* Error means no messages were sent */
 		sent = 0;