event/SocketMonitor: don't cancel if OnSocketReady() returns false

Expect OnSocketReady() to cancel events.  If it returns false, the
SocketMonitor may be destructed already.  This fixes a use-after-free
bug in the "httpd" output plugin.

NEWS

@@ -1,6 +1,7 @@
 ver 0.21.8 (not yet released)
 * output
   - httpd: add missing mutex lock
+  - httpd: fix use-after-free bug
 * fix Bonjour bug
 * fix build failure with GCC 9
 

src/db/plugins/ProxyDatabasePlugin.cxx

@@ -568,7 +568,8 @@ ProxyDatabase::OnSocketReady(gcc_unused unsigned flags) noexcept
 	if (!is_idle) {
 		// TODO: can this happen?
 		IdleMonitor::Schedule();
-		return false;
+		SocketMonitor::Cancel();
+		return true;
 	}
 
 	unsigned idle = (unsigned)mpd_recv_idle(connection, false);
@@ -586,7 +587,8 @@ ProxyDatabase::OnSocketReady(gcc_unused unsigned flags) noexcept
 	idle_received |= idle;
 	is_idle = false;
 	IdleMonitor::Schedule();
-	return false;
+	SocketMonitor::Cancel();
+	return true;
 }
 
 void

src/event/BufferedSocket.cxx

@@ -110,15 +110,9 @@ BufferedSocket::OnSocketReady(unsigned flags) noexcept
 	if (flags & READ) {
 		assert(!input.IsFull());
 
-		if (!ReadToBuffer())
+		if (!ReadToBuffer() || !ResumeInput())
 			return false;
 
-		if (!ResumeInput())
-			/* we must return "true" here or
-			   SocketMonitor::Dispatch() will call
-			   Cancel() on a freed object */
-			return true;
-
 		if (!input.IsFull())
 			ScheduleRead();
 	}

src/event/SocketMonitor.cxx

@@ -33,8 +33,8 @@ SocketMonitor::Dispatch(unsigned flags) noexcept
 {
 	flags &= GetScheduledFlags();
 
-	if (flags != 0 && !OnSocketReady(flags) && IsDefined())
+	if (flags != 0)
-		Cancel();
+		OnSocketReady(flags);
 }
 
 SocketMonitor::~SocketMonitor() noexcept