[trafficserver] branch master updated: heap-use-after-free: Access ua_session after HttpTunnel::chain_abort_all called due to bad post chunked data

[ok...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

oknet pushed a commit to branch master
in repository https://git-dual.apache.org/repos/asf/trafficserver.git

The following commit(s) were added to refs/heads/master by this push:
       new  e100051   heap-use-after-free: Access ua_session after HttpTunnel::chain_abort_all called due to bad post chunked data
e100051 is described below

commit e100051f29f08ebdac083cf93d7fa9c5b0435f87
Author: Oknet Xu <xu...@skyguard.com.cn>
AuthorDate: Tue Feb 28 22:50:31 2017 +0800

    heap-use-after-free: Access ua_session after HttpTunnel::chain_abort_all called due to bad post chunked data
---
 proxy/http/HttpSM.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/proxy/http/HttpSM.cc b/proxy/http/HttpSM.cc
index 6f02cb9..e0efc8d 100644
--- a/proxy/http/HttpSM.cc
+++ b/proxy/http/HttpSM.cc
@@ -5741,7 +5741,8 @@ HttpSM::do_setup_post_tunnel(HttpVC_t to_vc_type)
 
   // If we're half closed, we got a FIN from the client. Forward it on to the origin server
   // now that we have the tunnel operational.
-  if (ua_session->get_half_close_flag()) {
+  // HttpTunnel could broken due to bad chunked data and close all vc by chain_abort_all().
+  if (p->handler_state != HTTP_SM_POST_UA_FAIL && ua_session->get_half_close_flag()) {
     p->vc->do_io_shutdown(IO_SHUTDOWN_READ);
   }
 }

-- 
To stop receiving notification emails like this one, please contact
['"commits@trafficserver.apache.org" <co...@trafficserver.apache.org>'].