Protect from try_send completing the operation immediately

Fixes a possible use-after-free in case of continue_ops() calling try_send(),
then connect_peer() -> set_timer() -> trigger_nearest() -> handle_op_part() -> continue_ops() again
kv-update
Vitaliy Filippov 2023-12-30 17:11:52 +03:00
parent ec7dcd1be5
commit c4928e6ecd
1 changed files with 4 additions and 0 deletions

View File

@ -705,6 +705,8 @@ resume_1:
}
goto resume_2;
}
// Protect from try_send completing the operation immediately
op->inflight_count++;
for (int i = 0; i < op->parts.size(); i++)
{
if (!(op->parts[i].flags & PART_SENT))
@ -728,8 +730,10 @@ resume_1:
}
}
}
op->inflight_count--;
if (op->state == 1)
{
// Some suboperations have to be resent
return 0;
}
resume_2: