Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-6599

wininet: ros-diff causes use after free in open_http_connection

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • None
    • Wine
    • Operating System: ReactOS
      Platform: x86 Hardware

    Description

      Created an attachment (id=8077)
      Move server_release calls

      open_http_connection in dll\win32\wininet\http.c calls server_release (which in our implementation frees the server instantly) and then goes on to use the server pointer.
      This is correct with Wine's implementation (which uses a delayed free) AFAICT, but conflicts with our diff from r54263 ([WININET] - Disable connection keep-alive to avoid calling into msafd to close the connection later during DLL_PROCESS_DETACH).

      The ros-diff should probably be updated to also move the server_release call to a later point (-> patch). But this is rather ugly - perhaps there's a nicer solution?

      Found by Coverity - CID 716799.

      Attachments

        Activity

          People

            aicommander Cameron Gutman
            ThFabba ThFabba
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: