lihao/skynet
1
0
Fork 0
mirror of https://github.com/cloudwu/skynet.git synced 2026-07-22 02:53:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix double free

Browse Source 
In the mainloop function, calling __skynet_free__ frees the pointer which may has already been freed in __push_socket_data__.

mainloop(struct skynet_context * context, void * ud, int type, int session, uint32_t source, const void * msg, size_t sz) {
        struct harbor * h = ud;
        switch (type) {
        case PTYPE_SOCKET: {
                const struct skynet_socket_message * message = msg;
                switch(message->type) {
                case SKYNET_SOCKET_TYPE_DATA:
                        push_socket_data(h, message);
                        skynet_free(message->buffer);
                        // skip...

To fix this potential double-free bug, clear the pointer message->buffer in __push_socket_data__ after the pointer is freed.
This commit is contained in:
hwangcc23
2017-08-23 23:36:31 +08:00
parent fa763181c0
commit 40543d42d5
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
service-src/service_harbor.c
View File

@@ -421,6 +421,7 @@ push_socket_data(struct harbor *h, const struct skynet_socket_message * message)
}
if (s == NULL) {
skynet_free(message->buffer);
((struct skynet_socket_message *)message)->buffer = NULL;
skynet_error(h->ctx, "Invalid socket fd (%d) data", fd);
return;
}