upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-15 00:40:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: nil: Fix a latent NULL dereference in the DoH client request helper

Browse source 
isc__nm_http_request()'s error path reloaded sock->h2->connect.cstream after client_send() had already detached and freed it on a submit failure, dereferencing NULL. The helper is only used by the DoH unit tests. Guard the cleanup path against the detached stream.

Closes #6160

Merge branch '6160-fix-latent-NULL-dereference-in-http2' into 'main'

See merge request isc-projects/bind9!12247
This commit is contained in:
Ondřej Surý 2026-06-15 20:05:17 +02:00
commit 72ac4bbdb2
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/isc/netmgr/http.c
View file

@ -2097,8 +2097,15 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region,
return ISC_R_SUCCESS;
error:
/*
* client_send() detaches and frees the stream on a submit failure
* (it nullifies sock->h2->connect.cstream before submitting, then
* frees it on the failure branch), so the reloaded pointer can be
* NULL here. The caller still gets the error result and reports the
* failure itself.
*/
cstream = sock->h2->connect.cstream;
if (cstream->read_cb != NULL) {
if (cstream != NULL && cstream->read_cb != NULL) {
cstream->read_cb(handle, result, NULL, cstream->read_cbarg);
}
return result;