[trafficserver] branch 7.1.x updated: heap use after free

[zw...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/7.1.x by this push:
     new 5159005  heap use after free
5159005 is described below

commit 5159005cffcdada7d71f45898809268a8963f2e7
Author: Fei Deng <du...@gmail.com>
AuthorDate: Thu Feb 1 16:42:54 2018 -0600

    heap use after free
    
    (cherry picked from commit 630dcb663c68406c9a569285325a37a8db375017)
---
 proxy/http2/Http2ConnectionState.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc
index 1e5b2f9..7b62a31 100644
--- a/proxy/http2/Http2ConnectionState.cc
+++ b/proxy/http2/Http2ConnectionState.cc
@@ -1161,8 +1161,13 @@ Http2ConnectionState::release_stream(Http2Stream *stream)
 
     if (fini_received && total_client_streams_count == 0) {
       // We were shutting down, go ahead and terminate the session
+      // this is a member of Http2ConnectionState and will be freed
+      // when ua_session is destroyed
       ua_session->destroy();
-      ua_session = nullptr;
+
+      // Can't do this because we just destroyed right here ^,
+      // or we can use a local variable to do it.
+      // ua_session = nullptr;
     }
   }
 }

-- 
To stop receiving notification emails like this one, please contact
zwoop@apache.org.