From: Christos Tsantilas <chtsanti@users.sourceforge.net>
Date: Sat, 23 May 2015 12:15:40 +0000 (-0700)
Subject: Fix segmentation fault inside Adaptation::Icap::Xaction::swanSong
X-Git-Tag: SQUID_3_5_5~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=67e5decbc311c926e47e283e8f7822d355b01d22;p=thirdparty%2Fsquid.git

Fix segmentation fault inside Adaptation::Icap::Xaction::swanSong

The Adaptation::Icap::Xaction::swanSong may try to use an invalid
Icap::Xaction::cs object (Comm::ConnOpener object) if the  Comm::ConnOpener
is already gone (because its job finished) but the  Xaction::noteCommConnected
method is not called yet.

This patch makes the Adaptation::Icap::Xaction::cs object a CbcPointer instead
of a raw pointer and checks if the Xaction::cs object is still valid before
using it.

This is a Measurement Factory project
---

diff --git a/src/adaptation/icap/Xaction.cc b/src/adaptation/icap/Xaction.cc
index fd76fdbe82..81a37a8ffe 100644
--- a/src/adaptation/icap/Xaction.cc
+++ b/src/adaptation/icap/Xaction.cc
@@ -184,7 +184,7 @@ Adaptation::Icap::Xaction::dnsLookupDone(const ipcache_addrs *ia)
     connector = JobCallback(93,3, ConnectDialer, this, Adaptation::Icap::Xaction::noteCommConnected);
     cs = new Comm::ConnOpener(connection, connector, TheConfig.connect_timeout(service().cfg().bypass));
     cs->setHost(s.cfg().host.termedBuf());
-    AsyncJob::Start(cs);
+    AsyncJob::Start(cs.get());
 }
 
 /*
@@ -522,7 +522,7 @@ void Adaptation::Icap::Xaction::setOutcome(const Adaptation::Icap::XactOutcome &
 void Adaptation::Icap::Xaction::swanSong()
 {
     // kids should sing first and then call the parent method.
-    if (cs) {
+    if (cs.valid()) {
         debugs(93,6, HERE << id << " about to notify ConnOpener!");
         CallJobHere(93, 3, cs, Comm::ConnOpener, noteAbort);
         cs = NULL;
diff --git a/src/adaptation/icap/Xaction.h b/src/adaptation/icap/Xaction.h
index 4a9000ea90..5379f5ae63 100644
--- a/src/adaptation/icap/Xaction.h
+++ b/src/adaptation/icap/Xaction.h
@@ -12,8 +12,7 @@
 #include "AccessLogEntry.h"
 #include "adaptation/icap/ServiceRep.h"
 #include "adaptation/Initiate.h"
-#include "comm/forward.h"
-#include "CommCalls.h"
+#include "comm/ConnOpener.h"
 #include "HttpReply.h"
 #include "ipcache.h"
 #include "MemBuf.h"
@@ -163,8 +162,7 @@ protected:
     timeval icap_tio_finish;   /*time when the last byte of the ICAP responsewas received*/
 
 private:
-    Comm::ConnOpener *cs;
-    //CBDATA_CLASS2(Xaction);
+    Comm::ConnOpener::Pointer cs;
 };
 
 } // namespace Icap