diff options
| author | Fedor Indutny <fedor@indutny.com> | 2015-06-07 00:37:35 +0200 |
|---|---|---|
| committer | Fedor Indutny <fedor@indutny.com> | 2015-06-30 20:09:22 -0700 |
| commit | 9180140231823f8a9cd6c6d7cf05d809d76299f2 (patch) | |
| tree | 1fe4ff09763d4b8b5470dd28ff57aaf9008d6218 /src/tls_wrap.cc | |
| parent | 6c61ca5325a411c4b64177c5bca58030ea5b97a4 (diff) | |
| download | node-new-9180140231823f8a9cd6c6d7cf05d809d76299f2.tar.gz | |
_stream_wrap: prevent use after free in TLS
Queued write requests should be invoked on handle close, otherwise the
"consumer" might be already destroyed when the write callbacks of the
"consumed" handle will be invoked. Same applies to the shutdown
requests.
Make sure to "move" away socket from server to not break the
`connections` counter in `net.js`. Otherwise it might not call `close`
callback, or call it too early.
Fix: https://github.com/iojs/io.js/issues/1696
PR-URL: https://github.com/nodejs/io.js/pull/1910
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Diffstat (limited to 'src/tls_wrap.cc')
| -rw-r--r-- | src/tls_wrap.cc | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc index b8a648de92..d4c7c9055d 100644 --- a/src/tls_wrap.cc +++ b/src/tls_wrap.cc @@ -320,6 +320,10 @@ void TLSWrap::EncOutCb(WriteWrap* req_wrap, int status) { TLSWrap* wrap = req_wrap->wrap()->Cast<TLSWrap>(); req_wrap->Dispose(); + // We should not be getting here after `DestroySSL`, because all queued writes + // must be invoked with UV_ECANCELED + CHECK_NE(wrap->ssl_, nullptr); + // Handle error if (status) { // Ignore errors after shutdown @@ -331,9 +335,6 @@ void TLSWrap::EncOutCb(WriteWrap* req_wrap, int status) { return; } - if (wrap->ssl_ == nullptr) - return; - // Commit NodeBIO::FromBIO(wrap->enc_out_)->Read(nullptr, wrap->write_size_); |