You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by mi...@apache.org on 2023/11/18 14:47:42 UTC
svn commit: r1913941 - /httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch
Author: minfrin
Date: Sat Nov 18 14:47:42 2023
New Revision: 1913941
URL: http://svn.apache.org/viewvc?rev=1913941&view=rev
Log:
Add proposal.
Added:
httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch
Added: httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch
URL: http://svn.apache.org/viewvc/httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch?rev=1913941&view=auto
==============================================================================
--- httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch (added)
+++ httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch Sat Nov 18 14:47:42 2023
@@ -0,0 +1,44 @@
+Index: changes-entries/use-after-free.txt
+===================================================================
+--- changes-entries/use-after-free.txt (nonexistent)
++++ changes-entries/use-after-free.txt (working copy)
+@@ -0,0 +1,3 @@
++
++ *) core: Fix use after free warning with gcc -fanalyzer. [Joe Orton]
++
+Index: server/mpm_unix.c
+===================================================================
+--- server/mpm_unix.c (revision 1913940)
++++ server/mpm_unix.c (working copy)
+@@ -259,10 +259,12 @@
+ while (cur_extra) {
+ ap_generation_t old_gen;
+ extra_process_t *next = cur_extra->next;
++ pid_t pid = cur_extra->pid;
+
+- if (reclaim_one_pid(cur_extra->pid, action_table[cur_action].action)) {
+- if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+- mpm_callback(-1, cur_extra->pid, old_gen);
++ if (reclaim_one_pid(pid, action_table[cur_action].action)) {
++ if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
++ /* cur_extra dangling pointer from here. */
++ mpm_callback(-1, pid, old_gen);
+ }
+ else {
+ AP_DEBUG_ASSERT(1 == 0);
+@@ -307,10 +309,12 @@
+ while (cur_extra) {
+ ap_generation_t old_gen;
+ extra_process_t *next = cur_extra->next;
++ pid_t pid = cur_extra->pid;
+
+- if (reclaim_one_pid(cur_extra->pid, DO_NOTHING)) {
+- if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+- mpm_callback(-1, cur_extra->pid, old_gen);
++ if (reclaim_one_pid(pid, DO_NOTHING)) {
++ if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
++ /* cur_extra dangling pointer from here. */
++ mpm_callback(-1, pid, old_gen);
+ }
+ else {
+ AP_DEBUG_ASSERT(1 == 0);