Commit eb2e96b
inspector: fix crash when writing to closed inspector socket
ProtocolHandler::WriteRaw() dereferences tcp_ without a null check.
When the remote end disconnects, OnEof() resets tcp_ to nullptr, but
queued messages from the uv_async callback can still trigger Write()
on the same event loop iteration, causing a null pointer dereference
crash (EXCEPTION_ACCESS_VIOLATION on Windows).
Additionally, ParseWsFrames() can call OnEof() internally (on
compressed or error frames), which resets tcp_ mid-loop in OnData().
If the delegate callback triggered by OnWsFrame() then calls Write(),
it would also hit the null tcp_ crash.
Add null guards in:
- WsHandler::OnData: stop parsing loop when tcp_ becomes null
- WsHandler::Write: early return before frame encoding
- ProtocolHandler::WriteRaw: defensive fallback for all write paths
Fixes: #34833
Signed-off-by: piaoyingmin <piaoyingmin@bytedance.com>
PR-URL: #64209
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>1 parent a22a840 commit eb2e96b
1 file changed
Lines changed: 3 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -401,10 +401,11 @@ class WsHandler : public ProtocolHandler { | |||
| 401 | 401 | if (processed > 0) { | |
| 402 | 402 | remove_from_beginning(data, processed); | |
| 403 | 403 | } | |
| 404 | - } while (processed > 0 && !data->empty()); | ||
| 404 | + } while (processed > 0 && !data->empty() && tcp_); | ||
| 405 | 405 | } | |
| 406 | 406 | ||
| 407 | 407 | void Write(const std::vector<char> data) override { | |
| 408 | + if (!tcp_) return; | ||
| 408 | 409 | std::vector<char> output = encode_frame_hybi17(data); | |
| 409 | 410 | WriteRaw(output, WriteRequest::Cleanup); | |
| 410 | 411 | } | |
@@ -666,6 +667,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector, | |||
| 666 | 667 | ||
| 667 | 668 | int ProtocolHandler::WriteRaw(const std::vector<char>& buffer, | |
| 668 | 669 | uv_write_cb write_cb) { | |
| 670 | + if (!tcp_) return -1; | ||
| 669 | 671 | return tcp_->WriteRaw(buffer, write_cb); | |
| 670 | 672 | } | |
| 671 | 673 | ||
0 commit comments