walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix invalid memory free

This commit is contained in:
Tatsuhiro Tsujikawa 2015-05-22 23:36:34 +09:00
parent 9a0b9428da
commit f0379aa428
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/nghttp2_hd.c
View File

@ -544,7 +544,8 @@ int nghttp2_hd_entry_init(nghttp2_hd_entry *ent, uint8_t flags, uint8_t *name,
return 0; return 0;
fail2: fail2:
if (flags & NGHTTP2_HD_FLAG_NAME_ALLOC) { if ((flags & NGHTTP2_HD_FLAG_NAME_ALLOC) &&
(flags & NGHTTP2_HD_FLAG_NAME_GIFT) == 0) {
nghttp2_mem_free(mem, ent->nv.name); nghttp2_mem_free(mem, ent->nv.name);
} }
fail: fail:
@ -1894,7 +1895,11 @@ static int hd_inflate_commit_indname(nghttp2_hd_inflater *inflater,
return 0; return 0;
} }
nghttp2_mem_free(mem, nv.value); if (inflater->index < NGHTTP2_STATIC_TABLE_LENGTH) {
nghttp2_mem_free(mem, nv.value);
} else {
nghttp2_mem_free(mem, nv.name);
}
return NGHTTP2_ERR_NOMEM; return NGHTTP2_ERR_NOMEM;
} }

11
tests/failmalloc_test.c
View File

@ -458,13 +458,14 @@ static void run_nghttp2_hd(void) {
nghttp2_hd_inflater inflater; nghttp2_hd_inflater inflater;
nghttp2_bufs bufs; nghttp2_bufs bufs;
int rv; int rv;
nghttp2_nv nva1[] = {MAKE_NV(":scheme", "https"), nghttp2_nv nva1[] = {
MAKE_NV(":authority", "example.org"), MAKE_NV(":scheme", "https"), MAKE_NV(":authority", "example.org"),
MAKE_NV(":path", "/slashdot"), MAKE_NV(":path", "/slashdot"),
MAKE_NV("accept-encoding", "gzip, deflate")}; MAKE_NV("accept-encoding", "gzip, deflate"), MAKE_NV("foo", "bar")};
nghttp2_nv nva2[] = { nghttp2_nv nva2[] = {
MAKE_NV(":scheme", "https"), MAKE_NV(":authority", "example.org"), MAKE_NV(":scheme", "https"), MAKE_NV(":authority", "example.org"),
MAKE_NV(":path", "/style.css"), MAKE_NV("cookie", "nghttp2=FTW")}; MAKE_NV(":path", "/style.css"), MAKE_NV("cookie", "nghttp2=FTW"),
MAKE_NV("foo", "bar2")};
rv = frame_pack_bufs_init(&bufs); rv = frame_pack_bufs_init(&bufs);