MT#59962 xmlrpc2di: check XmlRpcSource existence before using

Don't appeal to the XmlRpcSource's members (e.g. `_ssl`)
if this has been freed via `this`.

To check this out see controllable delete behavior
via introduced getter `getsDeletedOnClose()`.

Should fix:

     freed_arg: close frees this.

     CID 542402: (#1 of 1): Read from pointer after free (USE_AFTER_FREE)
     use_after_free: Using freed pointer this.

Change-Id: I8f23564957c57491db8cf051e7296671bf2a698a
master
Donat Zenichev 1 month ago
parent aba95f88bf
commit 0a5b30dc96

@ -143,8 +143,12 @@ XmlRpcClient::close()
SSL_shutdown(_ssl_ssl);
XmlRpcUtil::log(4, "XmlRpcClient::close: after SSL_shutdown");
}
XmlRpcSource::close();
if (_ssl) {
bool source_deleted = XmlRpcSource::getsDeletedOnClose();
XmlRpcSource::close(); /* potentially removes the owner of _ssl via `this` */
if (!source_deleted && _ssl) {
// Post-socket shutdown
XmlRpcUtil::log(4, "XmlRpcClient::close: before SSL_free(_ssl_ssl)");
SSL_free(_ssl_ssl);

@ -34,7 +34,7 @@ namespace XmlRpc {
if (_deleteOnClose) {
XmlRpcUtil::log(2,"XmlRpcSource::close: deleting this");
_deleteOnClose = false;
delete this;
delete this; /* the one who is the last turns off the light */
}
}

@ -41,6 +41,8 @@ namespace XmlRpc {
//! Close the owned fd. If deleteOnClose was specified at construction, the object is deleted.
virtual void close();
bool getsDeletedOnClose() { return _deleteOnClose; }
//! Return true to continue monitoring this source
virtual unsigned handleEvent(unsigned eventType) = 0;

Loading…
Cancel
Save