[trafficserver] branch master updated: Crash at HttpSM::state_request_wait_for_transform_read

[ok...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

oknet pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git

The following commit(s) were added to refs/heads/master by this push:
       new  b8a96c7   Crash at HttpSM::state_request_wait_for_transform_read
b8a96c7 is described below

commit b8a96c74e14a9c2e8fe9ea774c54bfa3b2b1b36a
Author: Oknet Xu <xu...@skyguard.com.cn>
AuthorDate: Tue Feb 28 20:27:17 2017 +0800

    Crash at HttpSM::state_request_wait_for_transform_read
    
    In the function, it is try to get int64_t from 'data':
    
      int64_t size = *((int64_t)data);
    
    But TransformTerminus::handle_event callback m_tvc->m_cont (HttpSM)
    with 'data == nullptr'. ATS will crash at here.
    
    We only get size from data when the event is TRANSFORM_READ_READY, otherwise we do not.
---
 proxy/Transform.cc   | 2 +-
 proxy/http/HttpSM.cc | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/proxy/Transform.cc b/proxy/Transform.cc
index ef21d7c..f914dfa 100644
--- a/proxy/Transform.cc
+++ b/proxy/Transform.cc
@@ -254,7 +254,7 @@ TransformTerminus::handle_event(int event, void * /* edata ATS_UNUSED */)
 
         if (!m_called_user) {
           m_called_user = 1;
-          m_tvc->m_cont->handleEvent(ev, nullptr);
+          m_tvc->m_cont->handleEvent(ev, &m_read_vio);
         } else {
           ink_assert(m_read_vio._cont != nullptr);
           m_read_vio._cont->handleEvent(ev, &m_read_vio);
diff --git a/proxy/http/HttpSM.cc b/proxy/http/HttpSM.cc
index e520ea2..b530459 100644
--- a/proxy/http/HttpSM.cc
+++ b/proxy/http/HttpSM.cc
@@ -1188,10 +1188,11 @@ int
 HttpSM::state_request_wait_for_transform_read(int event, void *data)
 {
   STATE_ENTER(&HttpSM::state_request_wait_for_transform_read, event);
-  int64_t size = *((int64_t *)data);
+  int64_t size;
 
   switch (event) {
   case TRANSFORM_READ_READY:
+    size = *((int64_t *)data);
     if (size != INT64_MAX && size >= 0) {
       // We got a content length so update our internal
       //   data as well as fix up the request header

-- 
To stop receiving notification emails like this one, please contact
['"commits@trafficserver.apache.org" <co...@trafficserver.apache.org>'].