aniani/icecast-server
0
0
Fork 0
mirror of https://gitlab.xiph.org/xiph/icecast-server.git synced 2025-06-30 22:18:19 -04:00
Code

Fix possible segfaults when header allocation fails

Browse Source 
This fixes some possible segfaults that could happen if the header
(re)allocation fails.
This commit is contained in:
Marvin Scholz 2015-06-06 14:05:55 +02:00
parent 2b9440d671
commit c35760cd50
2 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/format.c
View File

@ -282,6 +282,14 @@ int format_advance_queue(source_t *source, client_t *client)
} }
/* Prepare headers
* If any error occurs in this function, return -1
* Do not send a error to the client using client_send_error
* here but instead set client->respcode to 500.
* Else client_send_error will destroy and free the client and all
* calling functions will use a already freed client struct and
* cause a segfault!
*/
static int format_prepare_headers (source_t *source, client_t *client) static int format_prepare_headers (source_t *source, client_t *client)
{ {
unsigned remaining; unsigned remaining;
@ -297,7 +305,7 @@ static int format_prepare_headers (source_t *source, client_t *client)
bytes = util_http_build_header(ptr, remaining, 0, 0, 200, NULL, source->format->contenttype, NULL, NULL, source, client); bytes = util_http_build_header(ptr, remaining, 0, 0, 200, NULL, source->format->contenttype, NULL, NULL, source, client);
if (bytes == -1) { if (bytes == -1) {
ICECAST_LOG_ERROR("Dropping client as we can not build response headers."); ICECAST_LOG_ERROR("Dropping client as we can not build response headers.");
client_send_error(client, 500, 0, "Header generation failed."); client->respcode = 500;
return -1; return -1;
} else if ((bytes + 1024) >= remaining) { /* we don't know yet how much to follow but want at least 1kB free space */ } else if ((bytes + 1024) >= remaining) { /* we don't know yet how much to follow but want at least 1kB free space */
void *new_ptr = realloc(ptr, bytes + 1024); void *new_ptr = realloc(ptr, bytes + 1024);
@ -308,12 +316,12 @@ static int format_prepare_headers (source_t *source, client_t *client)
bytes = util_http_build_header(ptr, remaining, 0, 0, 200, NULL, source->format->contenttype, NULL, NULL, source, client); bytes = util_http_build_header(ptr, remaining, 0, 0, 200, NULL, source->format->contenttype, NULL, NULL, source, client);
if (bytes == -1 ) { if (bytes == -1 ) {
ICECAST_LOG_ERROR("Dropping client as we can not build response headers."); ICECAST_LOG_ERROR("Dropping client as we can not build response headers.");
client_send_error(client, 500, 0, "Header generation failed."); client->respcode = 500;
return -1; return -1;
} }
} else { } else {
ICECAST_LOG_ERROR("Client buffer reallocation failed. Dropping client."); ICECAST_LOG_ERROR("Client buffer reallocation failed. Dropping client.");
client_send_error(client, 500, 0, "Buffer reallocation failed."); client->respcode = 500;
return -1; return -1;
} }
} }

18
src/source.c
View File

@ -952,12 +952,18 @@ static int _free_client(void *key)
{ {
client_t *client = (client_t *)key; client_t *client = (client_t *)key;
/* if no response has been sent then send a 404 */ switch (client->respcode) {
if (client->respcode == 0) case 0:
client_send_error(client, 404, 0, "Mount unavailable"); /* if no response has been sent then send a 404 */
else client_send_error(client, 404, 0, "Mount unavailable");
client_destroy(client); break;
case 500:
client_send_error(client, 500, 0, "Stream preparation error");
break;
default:
client_destroy(client);
break;
}
return 1; return 1;
} }