upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-11 09:45:28 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Guard against a detached stream in isc__nm_http_request() error path

Browse source 
On a submit failure, client_send() nullifies sock->h2->connect.cstream
and frees the stream before returning the error. The error: label in
isc__nm_http_request() reloaded that pointer and dereferenced it
unconditionally, reading through a NULL stream. The function is only
used by the DoH unit tests -- production DoH client send goes through
isc__nm_http_send()/client_httpsend(), whose submit failure is reported
via the NULL-safe send callback -- so this is a latent defect in the
test helper rather than a reachable named crash.

Skip the read callback when the stream has already been detached and
let the caller report the failure from the error result it receives.

Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit 7df91b7634)
This commit is contained in:
Ondřej Surý 2026-06-15 18:09:37 +02:00
parent 47d375b9e6
commit 72255dfc36
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/isc/netmgr/http.c
View file

@ -2105,8 +2105,15 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region,
return ISC_R_SUCCESS;
error:
/*
* client_send() detaches and frees the stream on a submit failure
* (it nullifies sock->h2->connect.cstream before submitting, then
* frees it on the failure branch), so the reloaded pointer can be
* NULL here. The caller still gets the error result and reports the
* failure itself.
*/
cstream = sock->h2->connect.cstream;
if (cstream->read_cb != NULL) {
if (cstream != NULL && cstream->read_cb != NULL) {
cstream->read_cb(handle, result, NULL, cstream->read_cbarg);
}
return result;