lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-02 01:17:52 +03:00
Code Activity

Fix use-after-free when socket is closed in a callback handler

Browse Source
This commit is contained in:
Aris Adamantiadis
2011-01-19 16:01:21 +01:00
parent 460d43f050
commit 84df46f805
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/socket.c
View File

@@ -188,6 +188,19 @@ void ssh_socket_set_callbacks(ssh_socket s, ssh_socket_callbacks callbacks){
s->callbacks=callbacks; s->callbacks=callbacks;
} }
/**
* @brief SSH poll callback. This callback will be used when an event
* caught on the socket.
*
* @param p Poll object this callback belongs to.
* @param fd The raw socket.
* @param revents The current poll events on the socket.
* @param userdata Userdata to be passed to the callback function,
* in this case the socket object.
*
* @return 0 on success, < 0 when the poll object has been removed
* from its poll context.
*/
int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int revents, void *v_s){ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int revents, void *v_s){
ssh_socket s=(ssh_socket )v_s; ssh_socket s=(ssh_socket )v_s;
char buffer[4096]; char buffer[4096];
@@ -218,7 +231,6 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
s->read_wontblock=1; s->read_wontblock=1;
r=ssh_socket_unbuffered_read(s,buffer,sizeof(buffer)); r=ssh_socket_unbuffered_read(s,buffer,sizeof(buffer));
if(r<0){ if(r<0){
err=-1;
if(p != NULL) if(p != NULL)
ssh_poll_set_events(p,ssh_poll_get_events(p) & ~POLLIN); ssh_poll_set_events(p,ssh_poll_get_events(p) & ~POLLIN);
if(s->callbacks && s->callbacks->exception){ if(s->callbacks && s->callbacks->exception){
@@ -274,7 +286,8 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
} }
/* TODO: Find a way to put back POLLOUT when buffering occurs */ /* TODO: Find a way to put back POLLOUT when buffering occurs */
} }
return err; /* Return -1 if one of the poll handlers disappeared */
return (s->poll_in == NULL || s->poll_out == NULL) ? -1 : 0;
} }
/** @internal /** @internal