summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--NEWS1
-rw-r--r--src/db/plugins/ProxyDatabasePlugin.cxx6
-rw-r--r--src/event/BufferedSocket.cxx8
-rw-r--r--src/event/SocketMonitor.cxx4
4 files changed, 8 insertions, 11 deletions
diff --git a/NEWS b/NEWS
index ae1e4a3b4..83362a28d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
ver 0.21.8 (not yet released)
* output
- httpd: add missing mutex lock
+ - httpd: fix use-after-free bug
* fix Bonjour bug
* fix build failure with GCC 9
diff --git a/src/db/plugins/ProxyDatabasePlugin.cxx b/src/db/plugins/ProxyDatabasePlugin.cxx
index c4fdce0a1..f80ffd277 100644
--- a/src/db/plugins/ProxyDatabasePlugin.cxx
+++ b/src/db/plugins/ProxyDatabasePlugin.cxx
@@ -568,7 +568,8 @@ ProxyDatabase::OnSocketReady(gcc_unused unsigned flags) noexcept
if (!is_idle) {
// TODO: can this happen?
IdleMonitor::Schedule();
- return false;
+ SocketMonitor::Cancel();
+ return true;
}
unsigned idle = (unsigned)mpd_recv_idle(connection, false);
@@ -586,7 +587,8 @@ ProxyDatabase::OnSocketReady(gcc_unused unsigned flags) noexcept
idle_received |= idle;
is_idle = false;
IdleMonitor::Schedule();
- return false;
+ SocketMonitor::Cancel();
+ return true;
}
void
diff --git a/src/event/BufferedSocket.cxx b/src/event/BufferedSocket.cxx
index c66eb9f42..ace399893 100644
--- a/src/event/BufferedSocket.cxx
+++ b/src/event/BufferedSocket.cxx
@@ -110,15 +110,9 @@ BufferedSocket::OnSocketReady(unsigned flags) noexcept
if (flags & READ) {
assert(!input.IsFull());
- if (!ReadToBuffer())
+ if (!ReadToBuffer() || !ResumeInput())
return false;
- if (!ResumeInput())
- /* we must return "true" here or
- SocketMonitor::Dispatch() will call
- Cancel() on a freed object */
- return true;
-
if (!input.IsFull())
ScheduleRead();
}
diff --git a/src/event/SocketMonitor.cxx b/src/event/SocketMonitor.cxx
index 0b2a36088..64cc42820 100644
--- a/src/event/SocketMonitor.cxx
+++ b/src/event/SocketMonitor.cxx
@@ -33,8 +33,8 @@ SocketMonitor::Dispatch(unsigned flags) noexcept
{
flags &= GetScheduledFlags();
- if (flags != 0 && !OnSocketReady(flags) && IsDefined())
- Cancel();
+ if (flags != 0)
+ OnSocketReady(flags);
}
SocketMonitor::~SocketMonitor() noexcept