[gnunet] 17/28: PEERSTORE: fix write-after-free in handle_{iterate_end,watch_record}

[gnunet]

This is an automated email from the git hooks/post-receive script.

martin-schanzenbach pushed a commit to branch master
in repository gnunet.

commit ecea740a0ca2801db85482e5f26c550fe05c9ac3
Author: ulfvonbelow <strilen@tilde.club>
AuthorDate: Sun Jan 29 06:17:52 2023 -0600

    PEERSTORE: fix write-after-free in handle_{iterate_end,watch_record}
    
    One of the tests - I forget which one, didn't write it down at the time -
    actually does cause h to be freed in its callback. If this isn't supposed to
    be allowed, we should find and fix that test.
    
    Signed-off-by: Martin Schanzenbach <schanzen@gnunet.org>
---
 src/peerstore/peerstore_api.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/peerstore/peerstore_api.c b/src/peerstore/peerstore_api.c
index b3e793d93..1c13369cf 100644
--- a/src/peerstore/peerstore_api.c
+++ b/src/peerstore/peerstore_api.c
@@ -608,9 +608,10 @@ handle_iterate_end (void *cls, const struct 
GNUNET_MessageHeader *msg)
   callback_cls = ic->callback_cls;
   ic->iterating = GNUNET_NO;
   GNUNET_PEERSTORE_iterate_cancel (ic);
+  /* NOTE: set this here and not after callback because callback may free h */
+  h->reconnect_delay = GNUNET_TIME_UNIT_ZERO;
   if (NULL != callback)
     callback (callback_cls, NULL, NULL);
-  h->reconnect_delay = GNUNET_TIME_UNIT_ZERO;
 }
 
 
@@ -781,9 +782,9 @@ handle_watch_record (void *cls, const struct 
StoreRecordMessage *msg)
     disconnect_and_schedule_reconnect (h);
     return;
   }
+  h->reconnect_delay = GNUNET_TIME_UNIT_ZERO;
   if (NULL != wc->callback)
     wc->callback (wc->callback_cls, record, NULL);
-  h->reconnect_delay = GNUNET_TIME_UNIT_ZERO;
   PEERSTORE_destroy_record (record);
 }
 

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.