fefdd70 Prevent use after free in fd_input_available

1 file Authored by Carl Henrik Lunde 7 years ago, Committed by jhrozek 7 years ago,
    Prevent use after free in fd_input_available
    
    When both TEVENT_FD_WRITE and TEVENT_FD_READ are set, and an error/EOF
    occurs when reading from the socket, we will get a use after free
    in the second call ares_process_fd.  The first call will free the watch
    structure via a callback.
    
    Prevent this by calling ares_process_fd only once.
    
    Invalid read of size 4
       at fd_input_available (async_resolv.c:147)
       by epoll_event_loop (tevent_epoll.c:728)
       by epoll_event_loop_once (tevent_epoll.c:926)
       by std_event_loop_once (tevent_standard.c:114)
       by _tevent_loop_once (tevent.c:533)
       by tevent_common_loop_wait (tevent.c:637)
       by std_event_loop_wait (tevent_standard.c:140)
       by server_loop (server.c:702)
       by main (data_provider_be.c:587)
     Address ... is 112 bytes inside a block of size 136 free'd
       at free (vg_replace_malloc.c:530)
       by _talloc_free_internal (talloc.c:1116)
       by _talloc_free (talloc.c:1647)
       by ares__close_sockets (ares__close_sockets.c:50)
       by handle_error (ares_process.c:679)
       by read_tcp_data (ares_process.c:391)
       by processfds (ares_process.c:138)
       by fd_input_available (async_resolv.c:144)
       by epoll_event_loop (tevent_epoll.c:728)
       by epoll_event_loop_once (tevent_epoll.c:926)
       by std_event_loop_once (tevent_standard.c:114)
       by _tevent_loop_once (tevent.c:533)
       by tevent_common_loop_wait (tevent.c:637)
       by std_event_loop_wait (tevent_standard.c:140)
       by server_loop (server.c:702)
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/3250
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    (cherry picked from commit 9676b464dd428557ff5a648e1351a3972440396f)
    
        
file modified
+3 -6