Skip to content

Segfault: use after free because of req.tagReleased() being called too late #222

Closed
@knecht

Description

@knecht

RequestRawMessageAdapter.onClose is called from ngx_http_free_request just before the ngx_http_request_t is freed.
If listeners are present, RequestRawMessageAdapter.onClose then submits a runnable to NginxClojureRT.workerExecutorService which should eventually call req.tagReleased(), then returns.
When RequestRawMessageAdapter.onClose returns, ngx_http_free_request frees the ngx_http_request_t.
At that time, the java side request is not marked as released, but the corresponding ngx_http_request_t is already freed.

If handlePostEvent then handles an event of type POST_EVENT_TYPE_HIJACK_SEND, the check hijackEvent.channel.request.isReleased() will return false, and ngx_http_clojure_hijack_send will try to read from the ngx_http_request_t structure which has already been freed.
Now a segfault will kill the process before the Runnable submitted by RequestRawMessageAdapter.onClose had a chance to call req.tagReleased()

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions