gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

控制外部指针在future中的传递层数。

Browse Source 
修复future-promise 回调函数中的use after free，包括web cache pend, web cache write和key keeper。
修复decrypt mirror中的写越界。
This commit is contained in:
zhengchao
2019-01-07 19:42:23 +06:00
parent dd223d547d
commit c303326c40
5 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
platform/src/key_keeper.cpp
View File

@@ -355,16 +355,14 @@ static void certstore_rpc_on_succ(void* result, void* user)
key_keeper_free_keyring((struct keyring*)kyr); key_keeper_free_keyring((struct keyring*)kyr);
} }
} }
ctx->ref_keeper->stat.new_issue++;
promise_success(p, (void*)kyr); promise_success(p, (void*)kyr);
key_keeper_free_keyring((struct keyring*)kyr); key_keeper_free_keyring((struct keyring*)kyr);
ctx->ref_keeper->stat.new_issue++;
} }
else else
{ {
promise_failed(p, FUTURE_ERROR_EXCEPTION, status_msg); promise_failed(p, FUTURE_ERROR_EXCEPTION, status_msg);
} }
//promise_dettach_ctx(p);
//ctx_destroy_cb((void*)ctx);
} }
static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user) static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user)

2
plugin/business/decrypt-mirroring/src/mirror_stream.cpp
View File

@@ -712,7 +712,7 @@ int deliver_init_log()
int i=0; int i=0;
int j=0; int j=0;
char mac_str[DELIVER_MACADDR_STR_LEN]={0}; char mac_str[DELIVER_MACADDR_STR_LEN+1]={0};
for(j = 0; j < 6; j++) for(j = 0; j < 6; j++)
{ {

2
plugin/business/pangu-http/src/pangu_http.cpp
View File

@@ -1292,7 +1292,7 @@ static void cache_pend_on_succ(future_result_t * result, void * user)
{ {
struct pangu_http_ctx * ctx = (struct pangu_http_ctx *)user; struct pangu_http_ctx * ctx = (struct pangu_http_ctx *)user;
const struct cached_meta* meta=NULL; const struct cached_meta* meta=NULL;
meta=cache_pending_result_read_meta(result); meta=cache_pending_result_read_meta(result, ctx->cmid);
ctx->resumed_cb=dummy_resume; ctx->resumed_cb=dummy_resume;
tfe_http_session_resume(ctx->ref_session); tfe_http_session_resume(ctx->ref_session);
ATOMIC_DEC(&(g_pangu_rt->stat_val[STAT_SUSPENDING])); ATOMIC_DEC(&(g_pangu_rt->stat_val[STAT_SUSPENDING]));

10
plugin/business/pangu-http/src/pangu_web_cache.cpp
View File

@@ -954,7 +954,7 @@ struct cache_pending_context
char* url; char* url;
struct cached_meta cached_obj_meta; struct cached_meta cached_obj_meta;
struct cache_mid* ref_mid; enum OBJECT_LOCATION location;
struct cache_handle* ref_handle; struct cache_handle* ref_handle;
struct tango_cache_result* ref_tango_cache_result; struct tango_cache_result* ref_tango_cache_result;
struct future* f_tango_cache_fetch; struct future* f_tango_cache_fetch;
@@ -976,9 +976,10 @@ void cache_pending_ctx_free_cb(void* p)
free(ctx); free(ctx);
return; return;
} }
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result) const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid)
{ {
struct cache_pending_context* ctx=(struct cache_pending_context*)result; struct cache_pending_context* ctx=(struct cache_pending_context*)result;
mid->location=ctx->location;
if(ctx->status==PENDING_RESULT_MISS) if(ctx->status==PENDING_RESULT_MISS)
{ {
return NULL; return NULL;
@@ -1016,7 +1017,7 @@ static void cache_read_meta_on_succ(future_result_t * result, void * user)
//NOT break intentionally. //NOT break intentionally.
case RESULT_TYPE_END: case RESULT_TYPE_END:
//last call. //last call.
ctx->ref_mid->location=_result->location; ctx->location=_result->location;
ATOMIC_DEC(&(ctx->ref_handle->stat_val[STAT_CACHE_PENDING])); ATOMIC_DEC(&(ctx->ref_handle->stat_val[STAT_CACHE_PENDING]));
promise_dettach_ctx(p); promise_dettach_ctx(p);
promise_success(p, ctx); promise_success(p, ctx);
@@ -1162,7 +1163,6 @@ enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, u
ctx->status=PENDING_RESULT_FOBIDDEN; ctx->status=PENDING_RESULT_FOBIDDEN;
ctx->ref_handle=handle; ctx->ref_handle=handle;
ctx->url=tfe_strdup(request->req_spec.url); ctx->url=tfe_strdup(request->req_spec.url);
ctx->ref_mid=_mid;
ctx->req_if_modified_since=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_MODIFIED_SINCE)); ctx->req_if_modified_since=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_MODIFIED_SINCE));
ctx->req_if_none_match=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_NONE_MATCH)); ctx->req_if_none_match=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_NONE_MATCH));
promise_set_ctx(p, ctx, cache_pending_ctx_free_cb); promise_set_ctx(p, ctx, cache_pending_ctx_free_cb);
@@ -1243,8 +1243,8 @@ static void wrap_cache_write_on_fail(enum e_future_error err, const char * what,
{ {
struct cache_write_future_ctx* ctx=(struct cache_write_future_ctx*)user; struct cache_write_future_ctx* ctx=(struct cache_write_future_ctx*)user;
TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache upload failed: %s %s lapse: %d", ctx->url, what, time(NULL)-ctx->start); TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache upload failed: %s %s lapse: %d", ctx->url, what, time(NULL)-ctx->start);
cache_write_future_ctx_free(ctx);
ATOMIC_INC(&(ctx->ref_handle->stat_val[STAT_CACHE_WRITE_ERR])); ATOMIC_INC(&(ctx->ref_handle->stat_val[STAT_CACHE_WRITE_ERR]));
cache_write_future_ctx_free(ctx);
} }
struct cache_write_context* web_cache_write_start(struct cache_handle* handle, unsigned int thread_id, struct cache_write_context* web_cache_write_start(struct cache_handle* handle, unsigned int thread_id,

2
plugin/business/pangu-http/src/pangu_web_cache.h
View File

@@ -48,7 +48,7 @@ const char* cache_pending_result_string(enum cache_pending_result);
struct cache_mid; struct cache_mid;
void cache_mid_clear(struct cache_mid **mid); void cache_mid_clear(struct cache_mid **mid);
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result); const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid);
enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, unsigned int thread_id, enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, unsigned int thread_id,
const struct tfe_http_half * request, struct cache_mid **mid, struct future* f_revalidate); const struct tfe_http_half * request, struct cache_mid **mid, struct future* f_revalidate);