diff options
| author | Garrett D'Amore <garrett@damore.org> | 2025-06-22 18:43:54 -0700 |
|---|---|---|
| committer | Garrett D'Amore <garrett@damore.org> | 2025-06-22 18:43:54 -0700 |
| commit | 548037bf5264a8a3bbb2139665bb604014568643 (patch) | |
| tree | d6d89f690f736a020c892eb3b9401b5c660e1b16 | |
| parent | 3a893b4a576925f3830ee141257458f7e6190ce6 (diff) | |
| download | nng-548037bf5264a8a3bbb2139665bb604014568643.tar.gz nng-548037bf5264a8a3bbb2139665bb604014568643.tar.bz2 nng-548037bf5264a8a3bbb2139665bb604014568643.zip | |
posix tcp: use after free in listener (need to stop before free)
| -rw-r--r-- | src/platform/posix/posix_tcplisten.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/platform/posix/posix_tcplisten.c b/src/platform/posix/posix_tcplisten.c index 508f4d1e..700af4c5 100644 --- a/src/platform/posix/posix_tcplisten.c +++ b/src/platform/posix/posix_tcplisten.c @@ -149,7 +149,7 @@ tcp_listener_cb(void *arg, unsigned events) tcp_listener *l = arg; nni_mtx_lock(&l->mtx); - if ((events & NNI_POLL_INVAL) != 0) { + if (((events & NNI_POLL_INVAL) != 0) || (l->closed)) { tcp_listener_doclose(l); nni_mtx_unlock(&l->mtx); return; @@ -263,6 +263,7 @@ tcp_listener_free(void *arg) { tcp_listener *l = arg; + tcp_listener_stop(l); // should usually already be stopped nni_posix_pfd_fini(&l->pfd); nni_mtx_fini(&l->mtx); NNI_FREE_STRUCT(l); |