Bug #507: Crash after ftpDataWriteCallback

A cbdata fence error when aborting FTP requests caused Squid to segfault
if a FTP PUT request was aborted while Squid was actively sending data
to the FTP server.

It is possible this fence error could also be triggered by other abort
conditions in FTP such as timeouts etc, producing slightly different symptoms.

diff --git a/src/ftp.cc b/src/ftp.cc
index d5b3877826070f9f7a1dea3fa0d8ebe7f61dde30..a3b6828e3bf053a6888a92a997921dbb1f5d1385 100644 (file)
--- a/src/ftp.cc
+++ b/src/ftp.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ftp.cc,v 1.338 2003/01/23 00:37:21 robertc Exp $
+ * $Id: ftp.cc,v 1.339 2003/02/01 13:38:44 hno Exp $
  *
  * DEBUG: section 9     File Transfer Protocol (FTP)
  * AUTHOR: Harvest Derived
@@ -270,6 +270,13 @@ FTPSM *FTP_SM_FUNCS[] =
 
 static void
 ftpStateFree(int fdnotused, void *data)
+{
+    FtpStateData *ftpState = (FtpStateData *)data;
+    cbdataFree(ftpState);
+}
+
+static void
+ftpStateFreed(void *data)
 {
     FtpStateData *ftpState = (FtpStateData *)data;
     if (ftpState == NULL)
@@ -309,7 +316,6 @@ ftpStateFree(int fdnotused, void *data)
        comm_close(ftpState->data.fd);
        ftpState->data.fd = -1;
     }
-    cbdataFree(ftpState);
 }
 
 static void
@@ -1060,7 +1066,7 @@ ftpStart(FwdState * fwd)
     FtpStateData *ftpState;
     HttpReply *reply;
 
-    CBDATA_INIT_TYPE(FtpStateData);
+    CBDATA_INIT_TYPE_FREECB(FtpStateData, ftpStateFreed);
     ftpState = cbdataAlloc(FtpStateData);
     debug(9, 3) ("ftpStart: '%s'\n", url);
     statCounter.server.all.requests++;
@@ -1705,6 +1711,9 @@ ftpSendPasv(FtpStateData * ftpState)
      * to delete the close handler which did NOT get called
      * to prevent ftpStateFree() getting called twice.
      * Instead we'll always call comm_close() on the ctrl FD.
+     *
+     * XXX this should not actually matter if the ftpState is cbdata
+     * managed correctly and comm close handlers are cbdata fenced
      */
     ftpState->data.fd = fd;
     snprintf(cbuf, 1024, "PASV\r\n");