diff options
| author | Garrett D'Amore <garrett@damore.org> | 2019-12-30 15:25:51 -0800 |
|---|---|---|
| committer | Garrett D'Amore <garrett@damore.org> | 2019-12-31 11:30:17 -0800 |
| commit | 3c6ecbd617d8d187f6963b5a43dc1abe5efae12b (patch) | |
| tree | 0743edae139ef4599adc71b0f9b57968abef48a5 /src/platform/windows | |
| parent | 092a24eea6ae494be8f7a5fe543e634cca01022e (diff) | |
| download | nng-1.2.3.tar.gz nng-1.2.3.tar.bz2 nng-1.2.3.zip | |
fixes #1079 Use after free panic in tcp_dialerv1.2.3
Diffstat (limited to 'src/platform/windows')
| -rw-r--r-- | src/platform/windows/win_resolv.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/platform/windows/win_resolv.c b/src/platform/windows/win_resolv.c index 745f03d1..ff356700 100644 --- a/src/platform/windows/win_resolv.c +++ b/src/platform/windows/win_resolv.c @@ -36,7 +36,7 @@ typedef struct resolv_item resolv_item; struct resolv_item { int family; int passive; - const char * name; + char * name; int proto; int socktype; uint16_t port; @@ -60,6 +60,7 @@ resolv_cancel(nni_aio *aio, void *arg, int rv) // so we can just discard everything. nni_aio_list_remove(aio); nni_mtx_unlock(&resolv_mtx); + nni_strfree(item->name); NNI_FREE_STRUCT(item); } else { // Resolver still working, so just unlink our AIO to @@ -225,9 +226,16 @@ resolv_ip(const char *host, const char *serv, int passive, int family, nni_aio_finish_error(aio, NNG_ENOMEM); return; } + if (host == NULL) { + item->name = NULL; + } else if ((item->name = nni_strdup(host)) == NULL) { + nni_aio_finish_error(aio, NNG_ENOMEM); + NNI_FREE_STRUCT(item); + return; + } + memset(&item->sa, 0, sizeof(item->sa)); item->passive = passive; - item->name = host; item->proto = proto; item->aio = aio; item->family = fam; @@ -243,6 +251,7 @@ resolv_ip(const char *host, const char *serv, int passive, int family, } if (rv != 0) { nni_mtx_unlock(&resolv_mtx); + nni_strfree(item->name); NNI_FREE_STRUCT(item); nni_aio_finish_error(aio, rv); return; @@ -301,6 +310,7 @@ resolv_worker(void *notused) nni_aio_finish(aio, rv, 0); } + nni_strfree(item->name); NNI_FREE_STRUCT(item); } nni_mtx_unlock(&resolv_mtx); |