Skip to contentSkip to conversation

Fix crash on http

PATCH In review Gustavo Luiz Duarte 2 participants 2 messages Sep 27, 2012 – Feb 1, 2013 Networking

lore
Share & tools
lore

Gustavo Luiz Duarte

author
#0 lore raw

PATCH 1/1 Fix crash on http

Don't free file->data on receiving FIN flag since it is used all over without checking. http_close() will be called later to free that memory. Downstream bug: http://bugzilla.redhat.com/show_bug.cgi?id=860834

---
 grub-core/net/http.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
grub-core/net/http.c +1 -1
index a7542d1..a5f6f31 100644
@@ -386,7 +386,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
 
   data->sock = grub_net_tcp_open (file->device->net->server,
                                  HTTP_PORT, http_receive,
-                                 http_err, http_err,
+                                 http_err, NULL,
                                  file);
   if (!data->sock)
     {
Signature · 1 line
1.7.11.4
#1 lore raw
Quoted 4 lines · Gustavo Luiz Duarte

Don't free file->data on receiving FIN flag since it is used all over without checking. http_close() will be called later to free that memory. Downstream bug: http://bugzilla.redhat.com/show_bug.cgi?id=860834

This patch of not just freeing fixes one instance of a more general problem. Please try the attached patch

Quoted 17 lines
---
 grub-core/net/http.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
grub-core/net/http.c +1 -1
index a7542d1..a5f6f31 100644
@@ -386,7 +386,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
 
   data->sock = grub_net_tcp_open (file->device->net->server,
                                  HTTP_PORT, http_receive,
-                                 http_err, http_err,
+                                 http_err, NULL,
                                  file);
   if (!data->sock)
     {
Signature · 2 lines
Regards
Vladimir 'φ-coder/phcoder' Serbinenko

=== modified file 'grub-core/net/http.c'

net/http.c +12 -3
@@ -157,9 +157,10 @@
 
   if (data->sock)
     grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
+  data->sock = 0;
   if (data->current_line)
     grub_free (data->current_line);
-  grub_free (data);
+  data->current_line = 0;
   file->device->net->eof = 1;
   file->device->net->stall = 1;
   if (file->size == GRUB_FILE_SIZE_UNKNOWN)

@@ -175,6 +176,12 @@
   http_data_t data = file->data;
   grub_err_t err;
 
+  if (!data->sock)
+    {
+      grub_netbuff_free (nb);
+      return GRUB_ERR_NONE;
+    }
+
   while (1)
     {
       char *ptr = (char *) nb->data;

@@ -432,7 +439,8 @@
   grub_err_t err;
   old_data = file->data;
   /* FIXME: Reuse socket?  */
-  grub_net_tcp_close (old_data->sock, GRUB_NET_TCP_ABORT);
+  if (old_data->sock)
+    grub_net_tcp_close (old_data->sock, GRUB_NET_TCP_ABORT);
   old_data->sock = 0;
 
   while (file->device->net->packs.first)

@@ -529,7 +537,8 @@
 
   if (!file->device->net->eof)
     file->device->net->stall = 0;
-  grub_net_tcp_unstall (data->sock);
+  if (data && data->sock)
+    grub_net_tcp_unstall (data->sock);
   return 0;
 }