diff options
| author |  Craig Tiller <ctiller@google.com> | 2016-11-15 09:29:44 -0800 |
|---|---|---|
| committer | Craig Tiller <ctiller@google.com> | 2016-11-15 09:29:44 -0800 |
| commit | 738e6dbc40ae5ba1075395403b63045fde4aebfe (patch) | |
| tree | 1d4ad5e97b15b31bb5e9cdf5ba56ce82b28cd9fa /src/core/lib | |
| parent | f392ce9598b39d4675a4a2f212488d53099ade80 (diff) | |
Fix use-after-free in time parse caching
Diffstat (limited to 'src/core/lib')
| -rw-r--r-- | src/core/lib/transport/metadata.c | 7 | ||||
| -rw-r--r-- | src/core/lib/transport/metadata.h | 4 |
2 files changed, 6 insertions, 5 deletions
diff --git a/src/core/lib/transport/metadata.c b/src/core/lib/transport/metadata.c index 977b34ca86..fac19b91d9 100644 --- a/src/core/lib/transport/metadata.c +++ b/src/core/lib/transport/metadata.c @@ -728,8 +728,8 @@ void *grpc_mdelem_get_user_data(grpc_mdelem *md, void (*destroy_func)(void *)) { return result; } -void grpc_mdelem_set_user_data(grpc_mdelem *md, void (*destroy_func)(void *), - void *user_data) { +void *grpc_mdelem_set_user_data(grpc_mdelem *md, void (*destroy_func)(void *), + void *user_data) { internal_metadata *im = (internal_metadata *)md; GPR_ASSERT(!is_mdelem_static(md)); GPR_ASSERT((user_data == NULL) == (destroy_func == NULL)); @@ -740,11 +740,12 @@ void grpc_mdelem_set_user_data(grpc_mdelem *md, void (*destroy_func)(void *), if (destroy_func != NULL) { destroy_func(user_data); } - return; + return (void *)gpr_atm_no_barrier_load(&im->user_data); } gpr_atm_no_barrier_store(&im->user_data, (gpr_atm)user_data); gpr_atm_rel_store(&im->destroy_user_data, (gpr_atm)destroy_func); gpr_mu_unlock(&im->mu_user_data); + return user_data; } grpc_slice grpc_mdstr_as_base64_encoded_and_huffman_compressed(grpc_mdstr *gs) { diff --git a/src/core/lib/transport/metadata.h b/src/core/lib/transport/metadata.h index 8dcfbb98bb..a4955a1ea7 100644 --- a/src/core/lib/transport/metadata.h +++ b/src/core/lib/transport/metadata.h @@ -120,8 +120,8 @@ size_t grpc_mdelem_get_size_in_hpack_table(grpc_mdelem *elem); is used as a type tag and is checked during user_data fetch. */ void *grpc_mdelem_get_user_data(grpc_mdelem *md, void (*if_destroy_func)(void *)); -void grpc_mdelem_set_user_data(grpc_mdelem *md, void (*destroy_func)(void *), - void *user_data); +void *grpc_mdelem_set_user_data(grpc_mdelem *md, void (*destroy_func)(void *), + void *user_data); /* Reference counting */ //#define GRPC_METADATA_REFCOUNT_DEBUG |