From ddebc52325e4bb6f02664d17947037cc7082ad31 Mon Sep 17 00:00:00 2001 From: Andy Green Date: Sun, 24 Feb 2019 06:16:57 +0800 Subject: [PATCH] uv: ensure watcher exists before operating on it This seen in the wild... ==20578== Invalid read of size 1 ==20578== at 0x4D2E018: uv_poll_stop (poll.c:112) ==20578== by 0x48BC159: elops_io_uv (libuv.c:684) ==20578== by 0x4872F55: __remove_wsi_socket_from_fds (pollfd.c:326) ==20578== by 0x486EF1B: __lws_close_free_wsi (close.c:425) ==20578== by 0x486F3E2: lws_close_free_wsi (close.c:518) ==20578== by 0x487564C: lws_service_fd_tsi (service.c:1033) ==20578== by 0x48BAEA9: lws_io_cb (libuv.c:117) ==20578== by 0x4D3606F: uv__io_poll (linux-core.c:379) ==20578== by 0x4D27714: uv_run (core.c:361) ==20578== by 0x48BC347: elops_run_pt_uv (libuv.c:735) ==20578== by 0x4875746: lws_service (service.c:1080) ==20578== by 0x401A51: main (main.c:309) ==20578== Address 0x58 is not stack'd, malloc'd or (recently) free'd --- lib/event-libs/libuv/libuv.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/event-libs/libuv/libuv.c b/lib/event-libs/libuv/libuv.c index c38eb2ac5..7ea7eb846 100644 --- a/lib/event-libs/libuv/libuv.c +++ b/lib/event-libs/libuv/libuv.c @@ -614,6 +614,7 @@ elops_close_handle_manually_uv(struct lws *wsi) wsi->desc.sockfd = LWS_SOCK_INVALID; wsi->w_read.uv.pwatcher = NULL; + wsi->told_event_loop_closed = 1; uv_close(h, lws_libuv_closewsi_m); } @@ -665,6 +666,12 @@ elops_io_uv(struct lws *wsi, int flags) assert(0); } + if (!w->uv.pwatcher || wsi->told_event_loop_closed) { + lwsl_err("%s: no watcher\n", __func__); + + return; + } + if (flags & LWS_EV_START) { if (flags & LWS_EV_WRITE) current_events |= UV_WRITABLE;