lib: http: poison parser references after freeing

Make it a little harder to slip in use-after-free bugs by nulling out
references to the parser object after handing it off to freeParser().

Reviewed-by: Trevor Norris <trev.norris@gmail.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/lib/_http_common.js b/lib/_http_common.js
index f3d9d4a2eb..7994cdd98d 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -192,7 +192,7 @@ exports.parsers = parsers;
 // up by doing `parser.data = {}`, which should
 // be done in FreeList.free.  `parsers.free(parser)`
 // should be all that is needed.
-function freeParser(parser, req) {
+function freeParser(parser, req, socket) {
   if (parser) {
     parser._headers = [];
     parser.onIncoming = null;
@@ -207,6 +207,9 @@ function freeParser(parser, req) {
   if (req) {
     req.parser = null;
   }
+  if (socket) {
+    socket.parser = null;
+  }
 }
 exports.freeParser = freeParser;