[trafficserver] branch master updated: heap use after free

[bc...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bcall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 630dcb6  heap use after free
630dcb6 is described below

commit 630dcb663c68406c9a569285325a37a8db375017
Author: Fei Deng <du...@gmail.com>
AuthorDate: Thu Feb 1 16:42:54 2018 -0600

    heap use after free
---
 proxy/http2/Http2ConnectionState.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc
index 54b2fb2..e14920e 100644
--- a/proxy/http2/Http2ConnectionState.cc
+++ b/proxy/http2/Http2ConnectionState.cc
@@ -1186,8 +1186,13 @@ Http2ConnectionState::release_stream(Http2Stream *stream)
     if (total_client_streams_count == 0) {
       if (fini_received) {
         // We were shutting down, go ahead and terminate the session
+        // this is a member of Http2ConnectionState and will be freed
+        // when ua_session is destroyed
         ua_session->destroy();
-        ua_session = nullptr;
+
+        // Can't do this because we just destroyed right here ^,
+        // or we can use a local variable to do it.
+        // ua_session = nullptr;
       } else if (shutdown_state == HTTP2_SHUTDOWN_IN_PROGRESS) {
         this_ethread()->schedule_imm_local((Continuation *)this, HTTP2_SESSION_EVENT_FINI);
       }

-- 
To stop receiving notification emails like this one, please contact
bcall@apache.org.