Skip to content

Commit

Permalink
udp,unix: fix sendmsg use-after-free (libuv#4321)
Browse files Browse the repository at this point in the history
Issue:
1. uv__io_poll calls uv__udp_io with revents == POLLIN + POLLOUT
2. uv__udp_io calls your recv_cb
3. you close the handle in callback
4. uv__udp_io calls uv__udp_sendmsg
5. uv__udp_sendmsg calls uv__io_feed
6. kaboom!
  • Loading branch information
gdestiny authored and triplefault committed Mar 6, 2024
1 parent e9f29cb commit 161a7f1
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/unix/udp.c
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ static void uv__udp_io(uv_loop_t* loop, uv__io_t* w, unsigned int revents) {
if (revents & POLLIN)
uv__udp_recvmsg(handle);

if (revents & POLLOUT) {
if (revents & POLLOUT && !uv__is_closing(handle)) {
uv__udp_sendmsg(handle);
uv__udp_run_completed(handle);
}
Expand Down

0 comments on commit 161a7f1

Please sign in to comment.