unix: Fix uv_getaddrinfo from deleting invalid data

If the uv_getaddrinfo_t handle is owned by its
data pointer, deleting the data in the callback
could cause uv_getaddrinfo_done to call freeaddrinfo
on an invalid pointer.
This commit is contained in:
Erick Tryzelaar 2011-09-17 08:38:29 -07:00 committed by Ben Noordhuis
parent 8f6f324746
commit 70e1032094
2 changed files with 9 additions and 6 deletions

View File

@ -575,6 +575,8 @@ int64_t uv_timer_get_repeat(uv_timer_t* timer) {
static int uv_getaddrinfo_done(eio_req* req) {
uv_getaddrinfo_t* handle = req->data;
struct addrinfo *res = handle->res;
handle->res = NULL;
uv_unref(handle->loop);
@ -587,10 +589,9 @@ static int uv_getaddrinfo_done(eio_req* req) {
uv_err_new(handle->loop, handle->retcode);
}
handle->cb(handle, handle->retcode, handle->res);
handle->cb(handle, handle->retcode, res);
freeaddrinfo(handle->res);
handle->res = NULL;
freeaddrinfo(res);
return 0;
}

View File

@ -31,10 +31,10 @@
static const char* name = "localhost";
static uv_getaddrinfo_t getaddrinfo_handle;
static int getaddrinfo_cbs = 0;
/* data used for running multiple calls concurrently */
static uv_getaddrinfo_t* getaddrinfo_handle;
static uv_getaddrinfo_t getaddrinfo_handles[CONCURRENT_COUNT];
static int callback_counts[CONCURRENT_COUNT];
@ -42,8 +42,9 @@ static int callback_counts[CONCURRENT_COUNT];
static void getaddrinfo_basic_cb(uv_getaddrinfo_t* handle,
int status,
struct addrinfo* res) {
ASSERT(handle == &getaddrinfo_handle);
ASSERT(handle == getaddrinfo_handle);
getaddrinfo_cbs++;
free(handle);
}
@ -71,9 +72,10 @@ static void getaddrinfo_cuncurrent_cb(uv_getaddrinfo_t* handle,
TEST_IMPL(getaddrinfo_basic) {
int r;
getaddrinfo_handle = (uv_getaddrinfo_t*)malloc(sizeof(uv_getaddrinfo_t));
r = uv_getaddrinfo(uv_default_loop(),
&getaddrinfo_handle,
getaddrinfo_handle,
&getaddrinfo_basic_cb,
name,
NULL,