gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#82 在tango_cache_head_object异常情况下，未dettach cache_pending_context，导致double free。

Browse Source
This commit is contained in:
zhengchao
2018-11-16 11:37:48 +08:00
parent a223599d52
commit 3da25a31ff
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugin/business/pangu-http/src/pangu_web_cache.cpp
View File

@@ -440,7 +440,7 @@ char* get_cache_key(const struct tfe_http_half * request, const struct cache_key
} }
char* url_no_qs=NULL; char* url_no_qs=NULL;
const char* cookie=NULL; const char* cookie=NULL;
char cookie_val[256]={0}; //most 256 bytes for cookie key char cookie_val[1024]={0}; //most 1024 bytes for cookie key
size_t key_size=strlen(request->req_spec.url)+sizeof(cookie_val); size_t key_size=strlen(request->req_spec.url)+sizeof(cookie_val);
char* cache_key=ALLOC(char, key_size); char* cache_key=ALLOC(char, key_size);
@@ -460,8 +460,7 @@ char* get_cache_key(const struct tfe_http_half * request, const struct cache_key
cookie_scanvalue(desc->include_cookie, cookie, cookie_val, sizeof(cookie_val)); cookie_scanvalue(desc->include_cookie, cookie, cookie_val, sizeof(cookie_val));
if(strlen(cookie_val)>0) if(strlen(cookie_val)>0)
{ {
strncat(cache_key, "/C/", key_size); snprintf(cache_key, key_size-strlen(cache_key), "/C/%s=%s", desc->include_cookie, cookie_val);
strncat(cache_key, cookie_val, key_size);
} }
} }
return cache_key; return cache_key;
@@ -1087,6 +1086,7 @@ enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, u
ret=tango_cache_head_object(handle->clients[thread_id], ctx->f_tango_cache_fetch, &meta); ret=tango_cache_head_object(handle->clients[thread_id], ctx->f_tango_cache_fetch, &meta);
if(ret<0) if(ret<0)
{ {
promise_dettach_ctx(p);
cache_pending_ctx_free_cb(ctx); cache_pending_ctx_free_cb(ctx);
_mid->result=PENDING_RESULT_FOBIDDEN; _mid->result=PENDING_RESULT_FOBIDDEN;
return _mid->result; return _mid->result;