unix: Fix uv_getaddrinfo from deleting invalid data

If the uv_getaddrinfo_t handle is owned by its data pointer, deleting the data in the callback could cause uv_getaddrinfo_done to call freeaddrinfo on an invalid pointer.
joyent · Sep 19, 2011 · 70e1032 · 70e1032
1 parent 8f6f324
commit 70e1032
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 6 deletions.
diff --git a/src/unix/core.c b/src/unix/core.c
@@ -575,6 +575,8 @@ int64_t uv_timer_get_repeat(uv_timer_t* timer) {
 
 static int uv_getaddrinfo_done(eio_req* req) {
   uv_getaddrinfo_t* handle = req->data;
+  struct addrinfo *res = handle->res;
+  handle->res = NULL;
 
   uv_unref(handle->loop);
 
@@ -587,10 +589,9 @@ static int uv_getaddrinfo_done(eio_req* req) {
     uv_err_new(handle->loop, handle->retcode);
   }
 
-  handle->cb(handle, handle->retcode, handle->res);
+  handle->cb(handle, handle->retcode, res);
 
-  freeaddrinfo(handle->res);
-  handle->res = NULL;
+  freeaddrinfo(res);
 
   return 0;
 }

diff --git a/test/test-getaddrinfo.c b/test/test-getaddrinfo.c
@@ -31,19 +31,20 @@
 
 static const char* name = "localhost";
 
-static uv_getaddrinfo_t getaddrinfo_handle;
 static int getaddrinfo_cbs = 0;
 
 /* data used for running multiple calls concurrently */
+static uv_getaddrinfo_t* getaddrinfo_handle;
 static uv_getaddrinfo_t getaddrinfo_handles[CONCURRENT_COUNT];
 static int callback_counts[CONCURRENT_COUNT];
 
 
 static void getaddrinfo_basic_cb(uv_getaddrinfo_t* handle,
                                  int status,
                                  struct addrinfo* res) {
-  ASSERT(handle == &getaddrinfo_handle);
+  ASSERT(handle == getaddrinfo_handle);
   getaddrinfo_cbs++;
+  free(handle);
 }
 
 
@@ -71,9 +72,10 @@ static void getaddrinfo_cuncurrent_cb(uv_getaddrinfo_t* handle,
 
 TEST_IMPL(getaddrinfo_basic) {
   int r;
+  getaddrinfo_handle = (uv_getaddrinfo_t*)malloc(sizeof(uv_getaddrinfo_t));
 
   r = uv_getaddrinfo(uv_default_loop(),
-                     &getaddrinfo_handle,
+                     getaddrinfo_handle,
                      &getaddrinfo_basic_cb,
                      name,
                      NULL,