diff options
author | 2018-02-08 14:23:11 -0800 | |
---|---|---|
committer | 2018-02-08 14:23:11 -0800 | |
commit | bf19c3332161b26f3942ed7b3a711bdc4dd923bc (patch) | |
tree | 8e6bf88c3925e71a993e0da1faa775abc5437b0e /src | |
parent | dfcb73dbb4c5774b49b4d2e54be7f9d2b0d2276b (diff) | |
parent | ba1c61450092dbde06ae4fc003f9e71b91ad332d (diff) |
Merge pull request #14379 from yashykt/chttp2_heap_use_after_free
Fix heap use-after-free bug in chttp2 reported by fuzzer
Diffstat (limited to 'src')
-rw-r--r-- | src/core/ext/transport/chttp2/transport/chttp2_transport.cc | 1 | ||||
-rw-r--r-- | src/core/ext/transport/chttp2/transport/writing.cc | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc index fe05e43960..2d92a7e6bb 100644 --- a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +++ b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc @@ -1668,6 +1668,7 @@ static void retry_initiate_ping_locked(void* tp, grpc_error* error) { if (error == GRPC_ERROR_NONE) { grpc_chttp2_initiate_write(t, GRPC_CHTTP2_INITIATE_WRITE_RETRY_SEND_PING); } + GRPC_CHTTP2_UNREF_TRANSPORT(t, "retry_initiate_ping_locked"); } void grpc_chttp2_ack_ping(grpc_chttp2_transport* t, uint64_t id) { diff --git a/src/core/ext/transport/chttp2/transport/writing.cc b/src/core/ext/transport/chttp2/transport/writing.cc index 95358ab525..1d6c9b0582 100644 --- a/src/core/ext/transport/chttp2/transport/writing.cc +++ b/src/core/ext/transport/chttp2/transport/writing.cc @@ -88,6 +88,7 @@ static void maybe_initiate_ping(grpc_chttp2_transport* t) { } if (!t->ping_state.is_delayed_ping_timer_set) { t->ping_state.is_delayed_ping_timer_set = true; + GRPC_CHTTP2_REF_TRANSPORT(t, "retry_initiate_ping_locked"); grpc_timer_init(&t->ping_state.delayed_ping_timer, next_allowed_ping, &t->retry_initiate_ping_locked); } |