From 40543d42d503991fb521795b026afc2e451abe11 Mon Sep 17 00:00:00 2001 From: hwangcc23 Date: Wed, 23 Aug 2017 23:36:31 +0800 Subject: [PATCH 1/2] Fix double free In the mainloop function, calling __skynet_free__ frees the pointer which may has already been freed in __push_socket_data__. mainloop(struct skynet_context * context, void * ud, int type, int session, uint32_t source, const void * msg, size_t sz) { struct harbor * h = ud; switch (type) { case PTYPE_SOCKET: { const struct skynet_socket_message * message = msg; switch(message->type) { case SKYNET_SOCKET_TYPE_DATA: push_socket_data(h, message); skynet_free(message->buffer); // skip... To fix this potential double-free bug, clear the pointer message->buffer in __push_socket_data__ after the pointer is freed. --- service-src/service_harbor.c | 1 + 1 file changed, 1 insertion(+) diff --git a/service-src/service_harbor.c b/service-src/service_harbor.c index 3e722fa9..be650521 100644 --- a/service-src/service_harbor.c +++ b/service-src/service_harbor.c @@ -421,6 +421,7 @@ push_socket_data(struct harbor *h, const struct skynet_socket_message * message) } if (s == NULL) { skynet_free(message->buffer); + ((struct skynet_socket_message *)message)->buffer = NULL; skynet_error(h->ctx, "Invalid socket fd (%d) data", fd); return; } From fad154f474a29d471066e6d60bc86f68333061f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=BA=91=E9=A3=8E?= Date: Thu, 24 Aug 2017 10:01:47 +0800 Subject: [PATCH 2/2] remove this free would be better --- service-src/service_harbor.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/service-src/service_harbor.c b/service-src/service_harbor.c index be650521..37157d34 100644 --- a/service-src/service_harbor.c +++ b/service-src/service_harbor.c @@ -420,8 +420,6 @@ push_socket_data(struct harbor *h, const struct skynet_socket_message * message) } } if (s == NULL) { - skynet_free(message->buffer); - ((struct skynet_socket_message *)message)->buffer = NULL; skynet_error(h->ctx, "Invalid socket fd (%d) data", fd); return; }