From cd5f5fcbde1dd92dabc59058ad90cf0e7dcfaad9 Mon Sep 17 00:00:00 2001

From: Colin Walters <walters@verbum.org>

Date: Mon, 3 Apr 2017 12:46:37 -0400

Subject: [PATCH] soup: Hold a ref to the pending URI during completion

 processing

It was reported that in the range request handling, we called `remove_pending()`

twice, and this could be viewed as a use-after-free. Currently though, the task

object already holds a strong reference, so I observed the refcount was 2, hence

there is no use-after-free in practice.

Reported-By: "Siddharth Sharma" <siddharth@redhat.com>

---

 src/libostree/ostree-fetcher-soup.c | 12 ++++++------

 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/libostree/ostree-fetcher-soup.c b/src/libostree/ostree-fetcher-soup.c

index b130b48..0a931c4 100644

--- a/src/libostree/ostree-fetcher-soup.c

+++ b/src/libostree/ostree-fetcher-soup.c

@@ -1040,21 +1040,20 @@ on_request_sent (GObject        *object,

                  gpointer        user_data) 

 {

   GTask *task = G_TASK (user_data);

-  OstreeFetcherPendingURI *pending;

-  GCancellable *cancellable;

+  /* Hold a ref to the pending across this function, since we remove

+   * it from the hash early in some cases, not in others. */

+  OstreeFetcherPendingURI *pending = pending_uri_ref (g_task_get_task_data (task));

+  GCancellable *cancellable = g_task_get_cancellable (task);

   GError *local_error = NULL;

   glnx_unref_object SoupMessage *msg = NULL;

-  pending = g_task_get_task_data (task);

-  cancellable = g_task_get_cancellable (task);

-

   pending->state = OSTREE_FETCHER_STATE_COMPLETE;

   pending->request_body = soup_request_send_finish ((SoupRequest*) object,

                                                    result, &local_error);

   if (!pending->request_body)

     goto out;

-  

+

   if (SOUP_IS_REQUEST_HTTP (object))

     {

       msg = soup_request_http_get_message ((SoupRequestHTTP*) object);

@@ -1183,6 +1182,7 @@ on_request_sent (GObject        *object,

       remove_pending (pending);

     }

+  pending_uri_unref (pending);

   g_object_unref (task);

 }

-- 

2.9.3