[TS-3802]: fix double free of MIOBuffer in SSLNetVConnection during SPDY inactivity.
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/ec747924 Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/ec747924 Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/ec747924 Branch: refs/heads/6.0.x Commit: ec7479243bead60a123e64dbef8b9d53fdade095 Parents: 0e703e1 Author: Sudheer Vinukonda <sudhe...@yahoo-inc.com> Authored: Tue Jul 28 17:59:10 2015 +0000 Committer: Sudheer Vinukonda <sudhe...@yahoo-inc.com> Committed: Tue Jul 28 17:59:10 2015 +0000 ---------------------------------------------------------------------- proxy/spdy/SpdyClientSession.cc | 8 ++++++++ 1 file changed, 8 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/ec747924/proxy/spdy/SpdyClientSession.cc ---------------------------------------------------------------------- diff --git a/proxy/spdy/SpdyClientSession.cc b/proxy/spdy/SpdyClientSession.cc index d9db07f..60c8e20 100644 --- a/proxy/spdy/SpdyClientSession.cc +++ b/proxy/spdy/SpdyClientSession.cc @@ -482,6 +482,14 @@ spdy_process_fetch_body(TSEvent event, SpdyClientSession *sm, TSFetchSM fetch_sm void SpdyClientSession::do_io_close(int alertno) { + if (vc) { + // vc is released (null'ed) within ProxyClientSession when handling + // TS_HTTP_SSN_CLOSE_HOOK, so, reset ssl_iobuf to prevent double free + SSLNetVConnection *ssl_vc = dynamic_cast<SSLNetVConnection *>(vc); + if (ssl_vc) { + ssl_vc->set_ssl_iobuf(NULL); + } + } // The object will be cleaned up from within ProxyClientSession::handle_api_return // This way, the object will still be alive for any SSN_CLOSE hooks do_api_callout(TS_HTTP_SSN_CLOSE_HOOK);