Skip to content

slice: Fix crash caused by use-after-free #13113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maskit merged 1 commit into from
Apr 22, 2026
Merged

slice: Fix crash caused by use-after-free #13113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions plugins/slice/Data.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
#include "Stage.h"

#include <netinet/in.h>
#include <string>
#include <unordered_map>

struct Config;
Expand All @@ -47,8 +48,8 @@ struct Data {

sockaddr_storage m_client_ip;

// transaction pointer
TSHttpTxn m_txnp{nullptr};
// cached effective URL for use during async intercept processing
std::string m_effective_url;

// for pristine/effective url coming in
TSMBuffer m_urlbuf{nullptr};
Expand Down
36 changes: 16 additions & 20 deletions plugins/slice/server.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,28 +90,24 @@ enum HeaderState {
};

static void
update_object_size(TSHttpTxn txnp, int64_t size, Config &config)
update_object_size(std::string_view const url, int64_t size, Config &config)
{
int urllen = 0;
char *urlstr = TSHttpTxnEffectiveUrlStringGet(txnp, &urllen);
if (urlstr != nullptr) {
if (size <= 0) {
DEBUG_LOG("Ignoring invalid content length for %.*s: %" PRId64, urllen, urlstr, size);
TSfree(urlstr);
return;
}
if (url.empty()) {
ERROR_LOG("Could not get URL from transaction.");
return;
}

if (static_cast<uint64_t>(size) >= config.m_min_size_to_slice) {
config.sizeCacheAdd({urlstr, static_cast<size_t>(urllen)}, static_cast<uint64_t>(size));
TSStatIntIncrement(config.stat_TP, 1);
} else {
config.sizeCacheRemove({urlstr, static_cast<size_t>(urllen)});
TSStatIntIncrement(config.stat_FP, 1);
}
if (size <= 0) {
DEBUG_LOG("Ignoring invalid content length for %.*s: %" PRId64, static_cast<int>(url.size()), url.data(), size);
return;
}

TSfree(urlstr);
if (static_cast<uint64_t>(size) >= config.m_min_size_to_slice) {
config.sizeCacheAdd(url, static_cast<uint64_t>(size));
TSStatIntIncrement(config.stat_TP, 1);
} else {
ERROR_LOG("Could not get URL from transaction.");
config.sizeCacheRemove(url);
TSStatIntIncrement(config.stat_FP, 1);
}
}

Expand Down Expand Up @@ -151,7 +147,7 @@ handleFirstServerHeader(Data *const data, TSCont const contp)
}
DEBUG_LOG("Passthru bytes: header: %" PRId64 " body: %" PRId64, hlen, clen);
if (clen != INT64_MAX) {
update_object_size(data->m_txnp, clen, *data->m_config);
update_object_size(data->m_effective_url, clen, *data->m_config);
TSVIONBytesSet(output_vio, hlen + clen);
} else {
TSVIONBytesSet(output_vio, clen);
Expand All @@ -171,7 +167,7 @@ handleFirstServerHeader(Data *const data, TSCont const contp)
return HeaderState::Fail;
}

update_object_size(data->m_txnp, blockcr.m_length, *data->m_config);
update_object_size(data->m_effective_url, blockcr.m_length, *data->m_config);

// set the resource content length from block response
data->m_contentlen = blockcr.m_length;
Expand Down
13 changes: 10 additions & 3 deletions plugins/slice/slice.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,14 @@ read_request(TSHttpTxn txnp, Config *const config, TSCont read_resp_hdr_contp)
std::unique_ptr<Data> data = std::make_unique<Data>(config);

data->m_method_type = header.method();
data->m_txnp = txnp;

// Cache the effective URL now while txnp is still valid
int efflen = 0;
char *effstr = TSHttpTxnEffectiveUrlStringGet(txnp, &efflen);
if (effstr != nullptr) {
data->m_effective_url.assign(effstr, efflen);
TSfree(effstr);
}

// set up feedback connect
if (AF_INET == ip->sa_family) {
Expand Down Expand Up @@ -200,8 +207,8 @@ read_request(TSHttpTxn txnp, Config *const config, TSCont read_resp_hdr_contp)
}
}

data->m_buffer_index = TSPluginVCIOBufferIndexGet(data->m_txnp); // default of m_buffer_index = 32KB
data->m_buffer_water_mark = TSPluginVCIOBufferWaterMarkGet(data->m_txnp); // default of m_buffer_water_mark = 0
data->m_buffer_index = TSPluginVCIOBufferIndexGet(txnp); // default of m_buffer_index = 32KB
data->m_buffer_water_mark = TSPluginVCIOBufferWaterMarkGet(txnp); // default of m_buffer_water_mark = 0

if (dbg_ctl.on()) {
int len = 0;
Expand Down