gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

控制外部指针在future中的传递层数。

Browse Source 
修复future-promise 回调函数中的use after free，包括web cache pend, web cache write和key keeper。
修复decrypt mirror中的写越界。
This commit is contained in:
zhengchao
2019-01-07 19:42:23 +06:00
parent dd223d547d
commit c303326c40
5 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
platform/src/key_keeper.cpp
View File

@@ -355,16 +355,14 @@ static void certstore_rpc_on_succ(void* result, void* user)
key_keeper_free_keyring((struct keyring*)kyr);
}
}
ctx->ref_keeper->stat.new_issue++;
promise_success(p, (void*)kyr);
key_keeper_free_keyring((struct keyring*)kyr);
ctx->ref_keeper->stat.new_issue++;
}
else
{
promise_failed(p, FUTURE_ERROR_EXCEPTION, status_msg);
}
//promise_dettach_ctx(p);
//ctx_destroy_cb((void*)ctx);
}
static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user)

2
plugin/business/decrypt-mirroring/src/mirror_stream.cpp
View File

@@ -712,7 +712,7 @@ int deliver_init_log()
int i=0;
int j=0;
char mac_str[DELIVER_MACADDR_STR_LEN]={0};
char mac_str[DELIVER_MACADDR_STR_LEN+1]={0};
for(j = 0; j < 6; j++)
{

2
plugin/business/pangu-http/src/pangu_http.cpp
View File

@@ -1292,7 +1292,7 @@ static void cache_pend_on_succ(future_result_t * result, void * user)
{
struct pangu_http_ctx * ctx = (struct pangu_http_ctx *)user;
const struct cached_meta* meta=NULL;
meta=cache_pending_result_read_meta(result);
meta=cache_pending_result_read_meta(result, ctx->cmid);
ctx->resumed_cb=dummy_resume;
tfe_http_session_resume(ctx->ref_session);
ATOMIC_DEC(&(g_pangu_rt->stat_val[STAT_SUSPENDING]));

10
plugin/business/pangu-http/src/pangu_web_cache.cpp
View File

@@ -954,7 +954,7 @@ struct cache_pending_context
char* url;
struct cached_meta cached_obj_meta;
struct cache_mid* ref_mid;
enum OBJECT_LOCATION location;
struct cache_handle* ref_handle;
struct tango_cache_result* ref_tango_cache_result;
struct future* f_tango_cache_fetch;
@@ -976,9 +976,10 @@ void cache_pending_ctx_free_cb(void* p)
free(ctx);
return;
}
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result)
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid)
{
struct cache_pending_context* ctx=(struct cache_pending_context*)result;
mid->location=ctx->location;
if(ctx->status==PENDING_RESULT_MISS)
{
return NULL;
@@ -1016,7 +1017,7 @@ static void cache_read_meta_on_succ(future_result_t * result, void * user)
//NOT break intentionally.
case RESULT_TYPE_END:
//last call.
ctx->ref_mid->location=_result->location;
ctx->location=_result->location;
ATOMIC_DEC(&(ctx->ref_handle->stat_val[STAT_CACHE_PENDING]));
promise_dettach_ctx(p);
promise_success(p, ctx);
@@ -1162,7 +1163,6 @@ enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, u
ctx->status=PENDING_RESULT_FOBIDDEN;
ctx->ref_handle=handle;
ctx->url=tfe_strdup(request->req_spec.url);
ctx->ref_mid=_mid;
ctx->req_if_modified_since=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_MODIFIED_SINCE));
ctx->req_if_none_match=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_NONE_MATCH));
promise_set_ctx(p, ctx, cache_pending_ctx_free_cb);
@@ -1243,8 +1243,8 @@ static void wrap_cache_write_on_fail(enum e_future_error err, const char * what,
{
struct cache_write_future_ctx* ctx=(struct cache_write_future_ctx*)user;
TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache upload failed: %s %s lapse: %d", ctx->url, what, time(NULL)-ctx->start);
cache_write_future_ctx_free(ctx);
ATOMIC_INC(&(ctx->ref_handle->stat_val[STAT_CACHE_WRITE_ERR]));
cache_write_future_ctx_free(ctx);
}
struct cache_write_context* web_cache_write_start(struct cache_handle* handle, unsigned int thread_id,

2
plugin/business/pangu-http/src/pangu_web_cache.h
View File

@@ -48,7 +48,7 @@ const char* cache_pending_result_string(enum cache_pending_result);
struct cache_mid;
void cache_mid_clear(struct cache_mid **mid);
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result);
const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid);
enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, unsigned int thread_id,
const struct tfe_http_half * request, struct cache_mid **mid, struct future* f_revalidate);