Commit 484e06d
tls: use after free in tls_wrap
The root cause is that `req_wrap` is created in `StreamBase::Write`
and passed to `TLSWrap::DoWrite`. In the TLS case the object gets
disposed and replaced with a new instance, but the caller's pointer is
never updated. When the `StreamBase::Write` method returns, it returns
a pointer to the freed object to the caller. In some cases when the
object memory has already been reused an assert is hit in
`WriteWrap::SetAllocatedStorage` because the pointer is non-null.
PR-URL: #18860
Refs: #18676
Reviewed-By: Anna Henningsen <anna@addaleax.net>1 parent 9169449 commit 484e06dCopy full SHA for 484e06d
File tree
Expand file treeCollapse file tree
2 files changed
+18
-16
lines changedOpen diff view settings
Filter options
- src
Expand file treeCollapse file tree
2 files changed
+18
-16
lines changedOpen diff view settings
Collapse file
+17-16Lines changed: 17 additions & 16 deletions
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| ||
310 | 310 | |
311 | 311 | |
312 | 312 | |
313 | | - |
314 | | - |
315 | | - |
316 | | - |
| 313 | + |
| 314 | + |
| 315 | + |
| 316 | + |
| 317 | + |
| 318 | + |
317 | 319 | |
318 | 320 | |
319 | 321 | |
| ||
579 | 581 | |
580 | 582 | |
581 | 583 | |
582 | | - |
583 | | - |
584 | | - |
585 | | - |
586 | | - |
587 | | - |
588 | | - |
589 | | - |
590 | | - |
591 | | - |
592 | | - |
593 | | - |
| 584 | + |
| 585 | + |
| 586 | + |
| 587 | + |
| 588 | + |
| 589 | + |
| 590 | + |
| 591 | + |
| 592 | + |
| 593 | + |
| 594 | + |
594 | 595 | |
595 | 596 | |
596 | 597 | |
|
Collapse file
+1Lines changed: 1 addition & 0 deletions
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| ||
152 | 152 | |
153 | 153 | |
154 | 154 | |
| 155 | + |
155 | 156 | |
156 | 157 | |
157 | 158 | |
|
0 commit comments