search

openziti / tlsuv

TLS and HTTP(s) client library for libuv
https://docs.openziti.io/tlsuv/
MIT License
45 stars 7 forks source link

double-free in http_read_cb() #174

Closed snej closed 1 year ago

snej commented 1 year ago

The Clang static analyzer found a code path where a heap block is freed twice, in http_read_cb() in http.c

  1. On line 96, free(buf->base);
  2. On line 132, free(buf->base);

Unless I’m missing something, flow of control will go from line 96 to line 132 without returning or changing buf or buf->base in the interim.

ekoby commented 1 year ago

good catch, in practice double-free would happen if the server is not HTTP -- sends something that fails to parse by HTTP parser