Prevent UAF when resizing iobatches

1 files changed, 5 insertions, 2 deletions

diff --git a/ot_http.c b/ot_http.c
index fc27eb8..4c4121b 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -216,11 +216,14 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t
       /* If the current batch's limit is reached, try to reallocate a new batch to work on */
       if (current->bytesleft > OT_BATCH_LIMIT) {
         io_batch *new_batch = realloc(cookie->batch, (cookie->batches + 1) * sizeof(io_batch));
+
         if (new_batch) {
           cookie->batch = new_batch;
-          if (OT_IOB_INIT(current) != -1)
-            current = cookie->batch + cookie->batches++;
+          if (OT_IOB_INIT(cookie->batch + cookie->batches) != -1)
+            ++cookie->batches;
         }
+        /* realloc may have moved the batches, so current is stale either way */
+        current = cookie->batch + cookie->batches - 1;
       }
       iob_addbuf_free(current, iovector[i].iov_base, iovector[i].iov_len);
     }