diff options
| author | Steven Luo | 2016-04-07 07:04:32 +0200 |
|---|---|---|
| committer | Samuel Thibault | 2016-04-07 10:27:42 +0200 |
| commit | bfb1ac14029ee72b19296109fba880c0551755d5 (patch) | |
| tree | 270d62cb3221dc7f5353f8e7d5198ec1d98fb295 /slirp/socket.c | |
| parent | slirp: don't crash when tcp_sockclosed() is called with a NULL tp (diff) | |
| download | qemu-bfb1ac14029ee72b19296109fba880c0551755d5.tar.gz qemu-bfb1ac14029ee72b19296109fba880c0551755d5.tar.xz qemu-bfb1ac14029ee72b19296109fba880c0551755d5.zip | |
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error
Samuel Thibault pointed out that it's possible that slirp_pollfds_poll()
will try to use a socket even after soread() returns an error, resulting
in an use-after-free if the socket was removed while handling the error.
Avoid this by refusing to continue to work with the socket in this case.
Signed-off-by: Steven Luo <steven+qemu@steven676.net>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Diffstat (limited to 'slirp/socket.c')
| -rw-r--r-- | slirp/socket.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/slirp/socket.c b/slirp/socket.c index b836c42b8e..7f022a6769 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -260,10 +260,11 @@ err: * so when OOB data arrives, we soread() it and everything * in the send buffer is sent as urgent data */ -void +int sorecvoob(struct socket *so) { struct tcpcb *tp = sototcpcb(so); + int ret; DEBUG_CALL("sorecvoob"); DEBUG_ARG("so = %p", so); @@ -276,11 +277,15 @@ sorecvoob(struct socket *so) * urgent data, or the read() doesn't return all the * urgent data. */ - soread(so); - tp->snd_up = tp->snd_una + so->so_snd.sb_cc; - tp->t_force = 1; - tcp_output(tp); - tp->t_force = 0; + ret = soread(so); + if (ret > 0) { + tp->snd_up = tp->snd_una + so->so_snd.sb_cc; + tp->t_force = 1; + tcp_output(tp); + tp->t_force = 0; + } + + return ret; } /* |