gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

控制外部指针在future中的传递层数。

Browse Source 
修复future-promise 回调函数中的use after free，包括web cache pend, web cache write和key keeper。
修复decrypt mirror中的写越界。
This commit is contained in:
zhengchao
2019-01-07 19:42:23 +06:00
parent dd223d547d
commit c303326c40
5 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
plugin/business/pangu-http/src/pangu_web_cache.cpp
View File

@@ -954,7 +954,7 @@ struct cache_pending_context
char* url;
struct cached_meta cached_obj_meta;
struct cache_mid* ref_mid;
enum OBJECT_LOCATION location;
struct cache_handle* ref_handle;
struct tango_cache_result* ref_tango_cache_result;
struct future* f_tango_cache_fetch;
@@ -976,9 +976,10 @@ void cache_pending_ctx_free_cb(void* p)
free(ctx);
return;
}
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result)
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid)
{
struct cache_pending_context* ctx=(struct cache_pending_context*)result;
mid->location=ctx->location;
if(ctx->status==PENDING_RESULT_MISS)
{
return NULL;
@@ -1015,8 +1016,8 @@ static void cache_read_meta_on_succ(future_result_t * result, void * user)
TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache meta read miss: %s", ctx->url);
//NOT break intentionally.
case RESULT_TYPE_END:
//last call.
ctx->ref_mid->location=_result->location;
//last call.
ctx->location=_result->location;
ATOMIC_DEC(&(ctx->ref_handle->stat_val[STAT_CACHE_PENDING]));
promise_dettach_ctx(p);
promise_success(p, ctx);
@@ -1162,7 +1163,6 @@ enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, u
ctx->status=PENDING_RESULT_FOBIDDEN;
ctx->ref_handle=handle;
ctx->url=tfe_strdup(request->req_spec.url);
ctx->ref_mid=_mid;
ctx->req_if_modified_since=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_MODIFIED_SINCE));
ctx->req_if_none_match=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_NONE_MATCH));
promise_set_ctx(p, ctx, cache_pending_ctx_free_cb);
@@ -1243,8 +1243,8 @@ static void wrap_cache_write_on_fail(enum e_future_error err, const char * what,
{
struct cache_write_future_ctx* ctx=(struct cache_write_future_ctx*)user;
TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache upload failed: %s %s lapse: %d", ctx->url, what, time(NULL)-ctx->start);
cache_write_future_ctx_free(ctx);
ATOMIC_INC(&(ctx->ref_handle->stat_val[STAT_CACHE_WRITE_ERR]));
cache_write_future_ctx_free(ctx);
}
struct cache_write_context* web_cache_write_start(struct cache_handle* handle, unsigned int thread_id,