Repository: trafficserver Updated Branches: refs/heads/master e15d3d30b -> 4ace71932
[TS-3112] : Add another null check per James Peach's code review Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/0be38616 Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/0be38616 Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/0be38616 Branch: refs/heads/master Commit: 0be38616636a0b18c2afa1cd1b14d96fa17275f0 Parents: f8ee03b Author: Sudheer Vinukonda <sudhe...@yahoo-inc.com> Authored: Fri Oct 3 16:46:22 2014 +0000 Committer: Sudheer Vinukonda <sudhe...@yahoo-inc.com> Committed: Fri Oct 3 16:46:22 2014 +0000 ---------------------------------------------------------------------- proxy/FetchSM.cc | 12 ++++++++++++ 1 file changed, 12 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/0be38616/proxy/FetchSM.cc ---------------------------------------------------------------------- diff --git a/proxy/FetchSM.cc b/proxy/FetchSM.cc index 4a79db4..596e9fb 100644 --- a/proxy/FetchSM.cc +++ b/proxy/FetchSM.cc @@ -249,6 +249,13 @@ FetchSM::InvokePluginExt(int fetch_event) has_sent_header = true; } + // TS-3112: always check 'contp' after handleEvent() + // since handleEvent effectively calls the plugin (or SPDY layer) + // which may call TSFetchDestroy in error conditions. + // TSFetchDestroy sets contp to NULL, but, doesn't destroy FetchSM yet, + // since, it¹s in a tight loop protected by 'recursion' counter. + // When handleEvent returns, 'recursion' is decremented and contp is + // already null, so, FetchSM gets destroyed. if (!contp) goto out; @@ -293,6 +300,11 @@ FetchSM::InvokePluginExt(int fetch_event) } contp->handleEvent(event, this); + + // contp may be null after handleEvent + if (!contp) + goto out; + } while (chunked_handler.state == ChunkedHandler::CHUNK_FLOW_CONTROL); } else if (check_body_done()){ contp->handleEvent(TS_FETCH_EVENT_EXT_BODY_DONE, this);
