diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2020-08-07 12:34:11 +0300 |
|---|---|---|
| committer | Sergey Kandaurov <pluknet@nginx.com> | 2020-08-07 12:34:11 +0300 |
| commit | 7d1a1fb6de71ba0ad7ac324a6c43a10a0f5d8ae6 (patch) | |
| tree | 47042105d555784b6d7caefd946e530640800764 /src/stream/ngx_stream_handler.c | |
| parent | 4ded4e3402b7e2ec847e55e47aaa44728a139665 (diff) | |
| download | nginx-7d1a1fb6de71ba0ad7ac324a6c43a10a0f5d8ae6.tar.gz nginx-7d1a1fb6de71ba0ad7ac324a6c43a10a0f5d8ae6.zip | |
QUIC: fixed possible use-after-free on stream cleanup.
A QUIC stream could be destroyed by handler while in ngx_quic_stream_input().
To detect this, ngx_quic_find_stream() is used to check that it still exists.
Previously, a stream id was passed to this routine off the frame structure.
In case of stream cleanup, it is freed along with other frames belonging to
the stream on cleanup. Then, a cleanup handler reuses last frames to update
MAX_STREAMS and serve other purpose. Thus, ngx_quic_find_stream() is passed
a reused frame with zeroed out part pointed by stream_id. If a stream with
id 0x0 still exists, this leads to use-after-free.
Diffstat (limited to 'src/stream/ngx_stream_handler.c')
0 files changed, 0 insertions, 0 deletions