gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#88 缓存应答消息体构建过程中，连接中断，http session被强制回收，http业务层和http解析层两次对cached_response调用了释放（double free）。

Browse Source 
目前业务层在tfe_http_session_response_set后，不再负责释放，解决方案比较dirty。
This commit is contained in:
zhengchao
2018-11-29 15:18:12 +08:00
parent ef7e2831a4
commit bcfed2bab1
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugin/business/pangu-http/src/pangu_http.cpp
View File

@@ -518,7 +518,7 @@ static void pangu_http_ctx_free(struct pangu_http_ctx * ctx)
} }
if(ctx->cached_response) if(ctx->cached_response)
{ {
tfe_http_half_free(ctx->cached_response); //Dirty close
ctx->cached_response=NULL; ctx->cached_response=NULL;
} }
@@ -1099,7 +1099,10 @@ static void cache_read_on_succ(future_result_t * result, void * user)
snprintf(temp, sizeof(temp), "%lu", meta->content_length); snprintf(temp, sizeof(temp), "%lu", meta->content_length);
tfe_http_std_field_write(ctx->cached_response, TFE_HTTP_CONT_LENGTH, temp); tfe_http_std_field_write(ctx->cached_response, TFE_HTTP_CONT_LENGTH, temp);
//Dirty code here.
tfe_http_session_response_set(ctx->ref_session, ctx->cached_response); tfe_http_session_response_set(ctx->ref_session, ctx->cached_response);
//From now, ownership of cached_response has been transfered to http session,
//bussines plugin only hold this pointer as an reference for writing response body.
tfe_http_half_write_body_begin(ctx->cached_response, 1); tfe_http_half_write_body_begin(ctx->cached_response, 1);
meta=NULL; meta=NULL;