diff options
| author | Wludzik, Jozef <jozef.wludzik@intel.com> | 2020-10-19 13:59:41 +0300 |
|---|---|---|
| committer | Jozef Wludzik <jozef.wludzik@intel.com> | 2020-10-22 09:23:24 +0300 |
| commit | c7d3422c108c6a88bbeffcea3edbb3f59e3992e3 (patch) | |
| tree | bd6bf11ba93dec9114ac962ebab35416fa430fb3 /http | |
| parent | 3fad0d59b94d951a752530d01db5451773f7d374 (diff) | |
| download | bmcweb-c7d3422c108c6a88bbeffcea3edbb3f59e3992e3.tar.xz | |
Avoid using deleted Connection in Response
Connection is destroyed when completeRequestHandler is nulled. It
causes that memory is freed. When Response::end() is called and
connection is not alive, completeRequest() method removes last
shared_ptr reference by setting nullptr on completeRequestHandler
member of Response. In this moment code is executed on destroyed
object and can cause stack overflow.
Fixed it by moving a call to completeRequest method to Asio
executor in completeRequestHandler.
Tested:
- Ran stress test that send a lot of GET and POST requests
without a bmcweb service crash
Change-Id: Idcf6a06dac32e9eac08285b9b53a5e8afe36c955
Signed-off-by: Wludzik, Jozef <jozef.wludzik@intel.com>
Diffstat (limited to 'http')
| -rw-r--r-- | http/http_connection.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/http/http_connection.h b/http/http_connection.h index ca3314b7e0..8aaabcddaa 100644 --- a/http/http_connection.h +++ b/http/http_connection.h @@ -340,7 +340,8 @@ class Connection : { needToCallAfterHandlers = true; res.completeRequestHandler = [self(shared_from_this())] { - self->completeRequest(); + boost::asio::post(self->adaptor.get_executor(), + [self] { self->completeRequest(); }); }; if (req->isUpgrade() && boost::iequals( |