thebestvibedev/tromcho.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protect from try_send completing the operation immediately

Browse Source 
Fixes a possible use-after-free in case of continue_ops() calling try_send(),
then connect_peer() -> set_timer() -> trigger_nearest() -> handle_op_part() -> continue_ops() again
This commit is contained in:
Vitaliy Filippov
2023-12-31 01:23:17 +03:00
parent ec7dcd1be5
commit c4928e6ecd
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cluster_client.cpp
+4
View File
@@ -705,6 +705,8 @@ resume_1:
} }
goto resume_2; goto resume_2;
} }
// Protect from try_send completing the operation immediately
op->inflight_count++;
for (int i = 0; i < op->parts.size(); i++) for (int i = 0; i < op->parts.size(); i++)
{ {
if (!(op->parts[i].flags & PART_SENT)) if (!(op->parts[i].flags & PART_SENT))
@@ -728,8 +730,10 @@ resume_1:
} }
} }
} }
op->inflight_count--;
if (op->state == 1) if (op->state == 1)
{ {
// Some suboperations have to be resent
return 0; return 0;
} }
resume_2: resume_2: