You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by su...@apache.org on 2015/07/28 20:00:05 UTC
trafficserver git commit: [TS-3802]: fix double free of MIOBuffer in
SSLNetVConnection during SPDY inactivity.
Repository: trafficserver
Updated Branches:
refs/heads/master 0e703e1e3 -> ec7479243
[TS-3802]: fix double free of MIOBuffer in SSLNetVConnection during SPDY inactivity.
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/ec747924
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/ec747924
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/ec747924
Branch: refs/heads/master
Commit: ec7479243bead60a123e64dbef8b9d53fdade095
Parents: 0e703e1
Author: Sudheer Vinukonda <su...@yahoo-inc.com>
Authored: Tue Jul 28 17:59:10 2015 +0000
Committer: Sudheer Vinukonda <su...@yahoo-inc.com>
Committed: Tue Jul 28 17:59:10 2015 +0000
----------------------------------------------------------------------
proxy/spdy/SpdyClientSession.cc | 8 ++++++++
1 file changed, 8 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/ec747924/proxy/spdy/SpdyClientSession.cc
----------------------------------------------------------------------
diff --git a/proxy/spdy/SpdyClientSession.cc b/proxy/spdy/SpdyClientSession.cc
index d9db07f..60c8e20 100644
--- a/proxy/spdy/SpdyClientSession.cc
+++ b/proxy/spdy/SpdyClientSession.cc
@@ -482,6 +482,14 @@ spdy_process_fetch_body(TSEvent event, SpdyClientSession *sm, TSFetchSM fetch_sm
void
SpdyClientSession::do_io_close(int alertno)
{
+ if (vc) {
+ // vc is released (null'ed) within ProxyClientSession when handling
+ // TS_HTTP_SSN_CLOSE_HOOK, so, reset ssl_iobuf to prevent double free
+ SSLNetVConnection *ssl_vc = dynamic_cast<SSLNetVConnection *>(vc);
+ if (ssl_vc) {
+ ssl_vc->set_ssl_iobuf(NULL);
+ }
+ }
// The object will be cleaned up from within ProxyClientSession::handle_api_return
// This way, the object will still be alive for any SSN_CLOSE hooks
do_api_callout(TS_HTTP_SSN_CLOSE_HOOK);