Browse Source

[backends: scgi,proxy,fastcgi] update *context immediately after *backend_get

- fixes use-after-free, usually caught by an assert in
  li_backend_wait_stop
personal/stbuehler/wip
Stefan Bühler 8 years ago
parent
commit
84325a5a06
  1. 8
      src/modules/mod_fastcgi.c
  2. 8
      src/modules/mod_proxy.c
  3. 8
      src/modules/mod_scgi.c

8
src/modules/mod_fastcgi.c

@ -101,21 +101,21 @@ static liHandlerResult fastcgi_handle(liVRequest *vr, gpointer param, gpointer *
fastcgi_context *ctx = (fastcgi_context*) param;
liFastCGIBackendWait *bwait = *context;
liFastCGIBackendConnection *bcon;
liBackendResult bres;
if (li_vrequest_is_handled(vr)) return LI_HANDLER_GO_ON;
LI_VREQUEST_WAIT_FOR_REQUEST_BODY(vr);
switch (li_fastcgi_backend_get(vr, ctx->pool, &bcon, &bwait)) {
bres = li_fastcgi_backend_get(vr, ctx->pool, &bcon, &bwait);
*context = bwait;
switch (bres) {
case LI_BACKEND_SUCCESS:
assert(NULL == bwait);
assert(NULL != bcon);
*context = bwait;
break;
case LI_BACKEND_WAIT:
assert(NULL != bwait);
*context = bwait;
return LI_HANDLER_WAIT_FOR_EVENT;
case LI_BACKEND_TIMEOUT:
li_vrequest_backend_dead(vr);

8
src/modules/mod_proxy.c

@ -248,6 +248,7 @@ static liHandlerResult proxy_handle(liVRequest *vr, gpointer param, gpointer *co
liBackendWait *bwait = (liBackendWait*) *context;
liBackendConnection *bcon = NULL;
proxy_context *ctx = (proxy_context*) param;
liBackendResult bres;
if (li_vrequest_is_handled(vr)) return LI_HANDLER_GO_ON;
@ -258,16 +259,15 @@ static liHandlerResult proxy_handle(liVRequest *vr, gpointer param, gpointer *co
return LI_HANDLER_ERROR;
}
switch (li_backend_get(vr, ctx->pool, &bcon, &bwait)) {
bres = li_backend_get(vr, ctx->pool, &bcon, &bwait);
*context = bwait;
switch (bres) {
case LI_BACKEND_SUCCESS:
assert(NULL == bwait);
assert(NULL != bcon);
*context = bwait;
break;
case LI_BACKEND_WAIT:
assert(NULL != bwait);
*context = bwait;
return LI_HANDLER_WAIT_FOR_EVENT;
case LI_BACKEND_TIMEOUT:
li_vrequest_backend_dead(vr);

8
src/modules/mod_scgi.c

@ -334,6 +334,7 @@ static liHandlerResult scgi_handle(liVRequest *vr, gpointer param, gpointer *con
liBackendWait *bwait = (liBackendWait*) *context;
liBackendConnection *bcon = NULL;
scgi_context *ctx = (scgi_context*) param;
liBackendResult bres;
if (li_vrequest_is_handled(vr)) return LI_HANDLER_GO_ON;
@ -344,16 +345,15 @@ static liHandlerResult scgi_handle(liVRequest *vr, gpointer param, gpointer *con
return LI_HANDLER_ERROR;
}
switch (li_backend_get(vr, ctx->pool, &bcon, &bwait)) {
bres = li_backend_get(vr, ctx->pool, &bcon, &bwait);
*context = bwait;
switch (bres) {
case LI_BACKEND_SUCCESS:
assert(NULL == bwait);
assert(NULL != bcon);
*context = bwait;
break;
case LI_BACKEND_WAIT:
assert(NULL != bwait);
*context = bwait;
return LI_HANDLER_WAIT_FOR_EVENT;
case LI_BACKEND_TIMEOUT:
li_vrequest_backend_dead(vr);

Loading…
Cancel
Save