chenBright commented on code in PR #3606:
URL: https://github.com/apache/brpc/pull/3606#discussion_r4307412240
##########
src/brpc/http_header.cpp:
##########
@@ -128,28 +170,39 @@ std::string& HttpHeader::GetOrAddHeader(const
std::string& key) {
return _content_type;
}
- bool is_set_cookie = IsSetCookie(key);
- // Only returns the first Set-Cookie header field for compatibility.
- if (is_set_cookie && nullptr != _first_set_cookie) {
- return *_first_set_cookie;
- }
-
std::string* val = _headers.seek(key);
if (nullptr == val) {
val = _headers.insert({ key, "" });
- if (is_set_cookie) {
- _first_set_cookie = val;
- }
}
return *val;
}
std::string& HttpHeader::AddHeader(const std::string& key) {
- std::string* val = _headers.insert({ key, "" });
- if (IsSetCookie(key) && nullptr == _first_set_cookie) {
- _first_set_cookie = val;
+ if (!IsSetCookie(key)) {
+ return *_headers.insert({ key, "" });
}
- return *val;
+ if (!_set_cookie_headers) {
+ _set_cookie_headers.reset(new SetCookieHeaders);
+ }
+ if (!_set_cookie_headers_dirty) {
+ _headers.erase(SET_COOKIE);
+ _set_cookie_headers_dirty = true;
+ }
+ _set_cookie_headers->push_back(std::make_pair(key, std::string()));
+ return _set_cookie_headers->back().second;
+}
+
+void HttpHeader::SyncSetCookieHeaders() {
+ if (!_set_cookie_headers_dirty) {
+ return;
+ }
+ _headers.erase(SET_COOKIE);
Review Comment:
`AppendHeader()` now inserts incrementally, but `SetHeader()` still forces a
full synchronization. With the default 16-bucket map, the following sequence
reaches the unsafe deletion path:
```cpp
brpc::HttpHeader h;
h.SetHeader("Set-Cookie", "sid=" + std::string(128, 'x'));
h.SetHeader("User-Agent", "client");
h.SetHeader("Set-Cookie", "sid=new");
```
`Set-Cookie` and `User-Agent` collide. During the final update,
`_headers.erase(SET_COOKIE)` removes the Cookie bucket head while retaining the
`User-Agent` node.
`MultiFlatMap::erase()` destroys the head’s strings at `flat_map_inl.h:473`,
then assigns the surviving node into those destroyed objects at lines 501–503
without reconstructing the element. With a heap-backed Cookie value, this can
cause a double-free or heap corruption.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
