From 3f7d4f4e8bc8cd9928fd0b1b280eb4c3f0ca9fa5 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Sun, 25 Oct 2026 20:58:17 +0100 Subject: Prevent UAF when resizing iobatches --- ot_http.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ot_http.c b/ot_http.c index fc27eb8..4c4121b 100644 --- a/ot_http.c +++ b/ot_http.c @@ -216,11 +216,14 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t /* If the current batch's limit is reached, try to reallocate a new batch to work on */ if (current->bytesleft > OT_BATCH_LIMIT) { io_batch *new_batch = realloc(cookie->batch, (cookie->batches + 1) * sizeof(io_batch)); + if (new_batch) { cookie->batch = new_batch; - if (OT_IOB_INIT(current) != -1) - current = cookie->batch + cookie->batches++; + if (OT_IOB_INIT(cookie->batch + cookie->batches) != -1) + ++cookie->batches; } + /* realloc may have moved the batches, so current is stale either way */ + current = cookie->batch + cookie->batches - 1; } iob_addbuf_free(current, iovector[i].iov_base, iovector[i].iov_len); } -- cgit v1.3