summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-09-11 16:41:49 +0200
committerBenoît Ganne <bganne@cisco.com>2019-09-12 12:33:14 +0000
commit6d6456ab421ee30f14aded964bad2d3ba55bcf20 (patch)
treea2ad408d2e0b1c368f0742fcdb9ee1d21f057b8a
parentb0876964893565d95fa934c9603dcde46a8caa0c (diff)
quic: fix use-after-free
Type: fix Change-Id: I5e5e37684e336ca992dae8ea1d39b1fb103802b1 Signed-off-by: Benoît Ganne <bganne@cisco.com>
-rw-r--r--src/plugins/quic/quic.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/plugins/quic/quic.c b/src/plugins/quic/quic.c
index 4a465fcbe30..97f03e52f5b 100644
--- a/src/plugins/quic/quic.c
+++ b/src/plugins/quic/quic.c
@@ -1404,6 +1404,11 @@ quic_on_client_connected (quic_ctx_t * ctx)
/* If the app opens a stream in its callback it may invalidate ctx */
ctx = quic_ctx_get (ctx_id, thread_index);
+ /*
+ * app_worker_connect_notify() might have reallocated pool, reload
+ * quic_session pointer
+ */
+ quic_session = session_get (ctx->c_s_index, thread_index);
quic_session->session_state = SESSION_STATE_LISTENING;
return 0;
@@ -1997,10 +2002,10 @@ quic_process_one_rx_packet (u64 udp_session_handle,
{
/* Right ctx found, create conn & remove from pool */
quic_create_connection(*ctx_index_ptr, sa, salen, packet_ctx->packet);
- pool_put (opening_ctx_pool, ctx_index_ptr);
*max_packet = packet_n + 1;
packet_ctx->thread_index = thread_index;
packet_ctx->ctx_index = *ctx_index_ptr;
+ pool_put (opening_ctx_pool, ctx_index_ptr);
goto updateOffset;
}
}));