luo980/libuv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

udp,unix: fix sendmsg use-after-free (#4321)

Browse Source 
Issue:
1. uv__io_poll calls uv__udp_io with revents == POLLIN + POLLOUT
2. uv__udp_io calls your recv_cb
3. you close the handle in callback
4. uv__udp_io calls uv__udp_sendmsg
5. uv__udp_sendmsg calls uv__io_feed
6. kaboom!
This commit is contained in:
Geddy 2024-02-29 06:32:43 +08:00 committed by GitHub
parent e8458b2402
commit a7c44d6748
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/unix/udp.c
View File

@ -141,7 +141,7 @@ static void uv__udp_io(uv_loop_t* loop, uv__io_t* w, unsigned int revents) {
if (revents & POLLIN)
uv__udp_recvmsg(handle);
if (revents & POLLOUT) {
if (revents & POLLOUT && !uv__is_closing(handle)) {
uv__udp_sendmsg(handle);
uv__udp_run_completed(handle);
}