diff options
author | Steven Luo <steven+qemu@steven676.net> | 2016-04-06 22:04:32 -0700 |
---|---|---|
committer | Timothy Pearson <tpearson@raptorengineering.com> | 2019-11-29 20:01:35 -0600 |
commit | 2986a5798049916618841a087d46caa65f3773de (patch) | |
tree | 34db0b4a32e408428a2696a8ed11ad0ecb2fcd36 /slirp/socket.c | |
parent | 0268ceb903cee877b1d4dbbe8f60c4a66ec6018b (diff) | |
download | hqemu-2986a5798049916618841a087d46caa65f3773de.zip hqemu-2986a5798049916618841a087d46caa65f3773de.tar.gz |
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error
Samuel Thibault pointed out that it's possible that slirp_pollfds_poll()
will try to use a socket even after soread() returns an error, resulting
in an use-after-free if the socket was removed while handling the error.
Avoid this by refusing to continue to work with the socket in this case.
Signed-off-by: Steven Luo <steven+qemu@steven676.net>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Diffstat (limited to 'slirp/socket.c')
-rw-r--r-- | slirp/socket.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/slirp/socket.c b/slirp/socket.c index b836c42..7f022a6 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -260,10 +260,11 @@ err: * so when OOB data arrives, we soread() it and everything * in the send buffer is sent as urgent data */ -void +int sorecvoob(struct socket *so) { struct tcpcb *tp = sototcpcb(so); + int ret; DEBUG_CALL("sorecvoob"); DEBUG_ARG("so = %p", so); @@ -276,11 +277,15 @@ sorecvoob(struct socket *so) * urgent data, or the read() doesn't return all the * urgent data. */ - soread(so); - tp->snd_up = tp->snd_una + so->so_snd.sb_cc; - tp->t_force = 1; - tcp_output(tp); - tp->t_force = 0; + ret = soread(so); + if (ret > 0) { + tp->snd_up = tp->snd_una + so->so_snd.sb_cc; + tp->t_force = 1; + tcp_output(tp); + tp->t_force = 0; + } + + return ret; } /* |