event/SocketMonitor: don't cancel if OnSocketReady() returns false

Expect OnSocketReady() to cancel events.  If it returns false, the
SocketMonitor may be destructed already.  This fixes a use-after-free
bug in the "httpd" output plugin.
This commit is contained in:
Max Kellermann
2019-04-03 23:23:56 +02:00
parent d2eb4df8fc
commit f6941f9a44
4 changed files with 8 additions and 11 deletions

View File

@@ -110,15 +110,9 @@ BufferedSocket::OnSocketReady(unsigned flags) noexcept
if (flags & READ) {
assert(!input.IsFull());
if (!ReadToBuffer())
if (!ReadToBuffer() || !ResumeInput())
return false;
if (!ResumeInput())
/* we must return "true" here or
SocketMonitor::Dispatch() will call
Cancel() on a freed object */
return true;
if (!input.IsFull())
ScheduleRead();
}