summaryrefslogtreecommitdiff
path: root/yhttpd/src/monitor
diff options
context:
space:
mode:
authorPaul Buetow <paul@buetow.org>2026-06-30 18:08:23 +0300
committerPaul Buetow <paul@buetow.org>2026-06-30 18:08:23 +0300
commitf03e1609ff438e6455bcd64de14dd4a447e8e6e5 (patch)
treeec7cb71a67c11f9304a3e8075407fc68ba2157f0 /yhttpd/src/monitor
parent6d079fb6c623e0897c6fc098c8d684565faa7af7 (diff)
Reclaim oversized-request fds (inline delete) + fix context ctor UAF
Root cause of the earlier 2s0 oversized-delete crashes: the context constructor initialized p_user=NULL but NOT p_map_params or p_response, so ~context's 'if (p_map_params) delete p_map_params' / 'if (p_response) delete p_response' ran on garbage (non-NULL) pointers on the early-delete paths (EOF-empty, hard read error, oversized) -> a corrupted std::map<string,string> destructor -> infinite _M_erase recursion -> SIGSEGV. It was never a libevent issue. Fix: - src/sock/context.cpp: initialize p_map_params = NULL and p_response = NULL in the constructor (p_user was already NULL). ~context null-guards them, so all early-delete paths are now safe. - src/sock/sock.cpp: the oversized-request branches (headers-incomplete- full and body-incomplete-full) now drop the request inline via del_event()+delete (exactly like the EOF/hard-error sibling branches) instead of leaking the fd/context. This closes the 2s0 fd-exhaustion DoS (the deliberate leak tradeoff) with no crash. Verified: 30 oversized POSTs -> open fd count stays at baseline (7->7, immediate reclaim, no leak), 0 restarts; normal login + multi-user chat work. Independent review: APPROVE (preferred the simplification to inline-delete, applied).
Diffstat (limited to 'yhttpd/src/monitor')
0 files changed, 0 insertions, 0 deletions