obgm/libcoap
2
0 Fork 0
mirror of https://github.com/obgm/libcoap.git synced 2026-11-12 03:40:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

net.c: Fix memory access after session is freed

Browse Source 
Make sure that session is not freed off in one of the callbacks while
testing the socket flags in the epoll logic.

Wrap the code with a coap_session_reference(session) and
coap_session_release(session) and remove all the interim wrappers.

Issue found when coap_read_session() internally does a coap_session_release().
This commit is contained in:
Jon Shallow committed 2019-11-28 11:57:42 +00:00
1 parent d6c25a9a07
commit 5a2fe9a261
1 file changed
+5 -12
Download Patch File Download Diff File Expand all files Collapse all files
src/net.c
+5 -12
View File
@@ -1501,24 +1501,19 @@ coap_io_do_events(coap_context_t *ctx, struct epoll_event *events, size_t nevent
else if (sock->session) {
coap_session_t *session = sock->session;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
if ((sock->flags & COAP_SOCKET_WANT_CONNECT) &&
(events[j].events & (EPOLLOUT|EPOLLERR|EPOLLHUP|EPOLLRDHUP))) {
sock->flags |= COAP_SOCKET_CAN_CONNECT;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_connect_session(session->context, session, now);
coap_session_release(session);
}
if ((sock->flags & COAP_SOCKET_WANT_READ) &&
(events[j].events & (EPOLLIN|EPOLLERR|EPOLLHUP|EPOLLRDHUP))) {
sock->flags |= COAP_SOCKET_CAN_READ;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_read_session(session->context, session, now);
coap_session_release(session);
}
if ((sock->flags & COAP_SOCKET_WANT_WRITE) &&
@@ -1529,12 +1524,10 @@ coap_io_do_events(coap_context_t *ctx, struct epoll_event *events, size_t nevent
*/
coap_epoll_ctl_mod(sock, EPOLLIN, __func__);
sock->flags |= COAP_SOCKET_CAN_WRITE;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_write_session(session->context, session, now);
coap_session_release(session);
}
/* Now dereference session so it can go away if needed */
coap_session_release(session);
}
}
else if (ctx->eptimerfd != -1) {