Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-16 00:00:07 +01:00
Code Issues Releases Wiki Activity

sspc: double free + rx ret not checked

Browse source 
Change-Id: I81b67cbb28591a20842fc7d6e09b78375845aae4
This commit is contained in:
Yichen Gu 2020-11-25 18:25:58 +08:00 • committed by Andy Green
parent d369a38fb1
commit 3e69956357
2 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/secure-streams/secure-streams-client.c
View file

@ -512,12 +512,8 @@ lws_sspc_destroy(lws_sspc_handle_t **ph)
if (h->dsh)
lws_dsh_destroy(&h->dsh);
if (h->cwsi) {
struct lws *wsi = h->cwsi;
if (h->cwsi)
h->cwsi = NULL;
if (wsi)
lws_set_timeout(wsi, 1, LWS_TO_KILL_SYNC);
}
/* clean out any pending metadata changes that didn't make it */

13
lib/secure-streams/secure-streams-serialize.c
View file

@ -684,10 +684,19 @@ payload_ff:
parser);
h->txc.peer_tx_cr_est -= n;
if (client_pss_to_sspc_h(pss, ssi))
if (client_pss_to_sspc_h(pss, ssi)) {
/* we still have an sspc handle */
ssi->rx(client_pss_to_userdata(pss),
int ret = ssi->rx(client_pss_to_userdata(pss),
(uint8_t *)cp, n, flags);
switch (ret) {
case LWSSSSRET_OK:
break;
case LWSSSSRET_DISCONNECT_ME:
goto hangup;
case LWSSSSRET_DESTROY_ME:
return LWSSSSRET_DESTROY_ME;
}
}
#if defined(LWS_WITH_DETAILED_LATENCY)
if (lws_det_lat_active(context)) {