Skip to content

Commit

Permalink
Bug Fix: Race condition between ws_accept() and function return
Browse files Browse the repository at this point in the history
In PR #82, the signature of the ws_socket() function was modified to receive a
'ws_server' structure as a parameter. However, the content of this structure
was only copied later when the thread for performing accepts() was created.
This could lead to a situation where, if the 'ws_server' structure was
allocated on the stack, a potential function return (prior to thread execution)
would render the address invalid, effectively creating a race condition between
thread creation and function return.

The fix is straightforward: simply have the 'ws_accept_params' structure store
the 'ws_server' structure itself instead of a pointer to it.

This should address issue #86.
  • Loading branch information
Theldus committed Dec 14, 2023
1 parent 2169643 commit 24e6fae
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions src/ws.c
Original file line number Diff line number Diff line change
Expand Up @@ -1627,7 +1627,7 @@ static void *ws_establishconnection(void *vclient)
struct ws_accept_params
{
int sock;
struct ws_server *ws_srv;
struct ws_server ws_srv;
};

/**
Expand Down Expand Up @@ -1687,7 +1687,7 @@ static void *ws_accept(void *data)
{
if (client_socks[i].client_sock == -1)
{
memcpy(&client_socks[i].ws_srv, ws_prm->ws_srv,
memcpy(&client_socks[i].ws_srv, &ws_prm->ws_srv,
sizeof(struct ws_server));

client_socks[i].client_sock = new_sock;
Expand Down Expand Up @@ -1810,11 +1810,13 @@ int ws_socket(struct ws_server *ws_srv)
/* Ignore 'unused functions' warnings. */
((void)skip_frame);

/* Allocates our parameters data. */
/* Allocates our parameters data and copy the ws_server structure. */
ws_prm = malloc(sizeof(*ws_prm));
if (!ws_prm)
panic("Unable to allocate ws parameters, out of memory!\n");

memcpy(&ws_prm->ws_srv, ws_srv, sizeof(*ws_srv));

#ifdef _WIN32
WSADATA wsaData;
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0)
Expand Down Expand Up @@ -1844,8 +1846,7 @@ int ws_socket(struct ws_server *ws_srv)
memset(client_socks, -1, sizeof(client_socks));

/* Accept connections. */
ws_prm->sock = sock;
ws_prm->ws_srv = ws_srv;
ws_prm->sock = sock;

if (!ws_srv->thread_loop)
ws_accept(ws_prm);
Expand Down

0 comments on commit 24e6fae

Please sign in to comment.