diff options
| author | Vsevolod Stakhov <vsevolod@highsecure.ru> | 2015-05-12 15:26:42 +0100 |
|---|---|---|
| committer | Vsevolod Stakhov <vsevolod@highsecure.ru> | 2015-05-12 15:26:42 +0100 |
| commit | 780bb6dfaefc471f4b8d2100642a2c1af6a2623b (patch) | |
| tree | 08fc77be7b31665e425f5aaef910ebbfcbab8cc2 | |
| parent | 03bcabb80535bb9a3bc29d92c8eb26ed43262a98 (diff) | |
| download | rspamd-780bb6dfaefc471f4b8d2100642a2c1af6a2623b.tar.gz rspamd-780bb6dfaefc471f4b8d2100642a2c1af6a2623b.zip | |
Fix zero-copy mode in lua_http (double free).
| -rw-r--r-- | src/libutil/http.c | 2 | ||||
| -rw-r--r-- | src/lua/lua_http.c | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/src/libutil/http.c b/src/libutil/http.c index ff43ebd11..5e589afc2 100644 --- a/src/libutil/http.c +++ b/src/libutil/http.c @@ -1592,7 +1592,7 @@ rspamd_http_connection_write_message (struct rspamd_http_connection *conn, } if (msg->body != NULL) { - if (msg->body_buf.str == NULL) { + if (msg->body_buf.str == NULL && msg->body_buf.len == 0) { msg->body_buf.str = msg->body->str; } priv->out[i].iov_base = pbody; diff --git a/src/lua/lua_http.c b/src/lua/lua_http.c index 7e48b7fd6..1baef5ed4 100644 --- a/src/lua/lua_http.c +++ b/src/lua/lua_http.c @@ -410,6 +410,8 @@ lua_http_request (lua_State *L) msg->body = g_string_new (NULL); msg->body->str = (gchar *)t->start; msg->body->len = t->len; + /* It is not safe unless we set len to avoid body_buf to be freed */ + msg->body_buf.len = t->len; } } |