bughz/3proxy
1
0
Fork 0
mirror of https://github.com/3proxy/3proxy.git synced 2026-11-05 09:25:49 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

proxy: a CONNECT's request line the tail's own, not a copy

Browse Source 
A client whose fiber gave up its stack while relayed never comes back to
the end of proxychild(), which frees what it allocated: the request line
and the FTP base were lost with each CONNECT, the tail having a copy of
the line. The line is the tail's now, taken back if mapping returns, and
the FTP base is freed before mapping.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Vladimir Dubrovin 2026-10-26 00:16:29 +03:00
parent 90d798eaaf
commit 5f892b38d8
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/proxy.c
View File

@ -1295,10 +1295,22 @@ for(;;){
}
hdrfree(&buf, &bufown);
/* mapping its last thing, but in a request httpsrv hands over, whose
end is httpsrv's: the rest of the end can be a loop's */
if(!param->onerequest && (param->maptaildata = req? (void *)strdup((char *)req) : NULL))
end is httpsrv's: the rest of the end can be a loop's, which this
function's own may then never reach. What it would free is freed
now, and the request line is the tail's, back here if mapping
returns. */
if(!param->onerequest && req){
freeptr(&ftpbase);
param->maptaildata = req;
req = NULL;
param->maptail = proxytail;
}
param->res = mapsocket(param, param->srv->timeouts[CONNECTION_L]);
if(param->maptail == proxytail){
req = param->maptaildata;
param->maptaildata = NULL;
param->maptail = NULL;
}
RETURN(param->res);
}