diff options
author | Fedor Indutny <fedor@indutny.com> | 2015-06-07 00:37:35 +0200 |
---|---|---|
committer | Fedor Indutny <fedor@indutny.com> | 2015-06-30 20:09:22 -0700 |
commit | 9180140231823f8a9cd6c6d7cf05d809d76299f2 (patch) | |
tree | 1fe4ff09763d4b8b5470dd28ff57aaf9008d6218 /test/parallel/test-stream-wrap.js | |
parent | 6c61ca5325a411c4b64177c5bca58030ea5b97a4 (diff) | |
download | android-node-v8-9180140231823f8a9cd6c6d7cf05d809d76299f2.tar.gz android-node-v8-9180140231823f8a9cd6c6d7cf05d809d76299f2.tar.bz2 android-node-v8-9180140231823f8a9cd6c6d7cf05d809d76299f2.zip |
_stream_wrap: prevent use after free in TLS
Queued write requests should be invoked on handle close, otherwise the
"consumer" might be already destroyed when the write callbacks of the
"consumed" handle will be invoked. Same applies to the shutdown
requests.
Make sure to "move" away socket from server to not break the
`connections` counter in `net.js`. Otherwise it might not call `close`
callback, or call it too early.
Fix: https://github.com/iojs/io.js/issues/1696
PR-URL: https://github.com/nodejs/io.js/pull/1910
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Diffstat (limited to 'test/parallel/test-stream-wrap.js')
-rw-r--r-- | test/parallel/test-stream-wrap.js | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/test/parallel/test-stream-wrap.js b/test/parallel/test-stream-wrap.js new file mode 100644 index 0000000000..e7a7ecddd2 --- /dev/null +++ b/test/parallel/test-stream-wrap.js @@ -0,0 +1,39 @@ +'use strict'; +const common = require('../common'); +const assert = require('assert'); + +const StreamWrap = require('_stream_wrap'); +const Duplex = require('stream').Duplex; +const ShutdownWrap = process.binding('stream_wrap').ShutdownWrap; + +var done = false; + +function testShutdown(callback) { + var stream = new Duplex({ + read: function() { + }, + write: function() { + } + }); + + var wrap = new StreamWrap(stream); + + var req = new ShutdownWrap(); + req.oncomplete = function(code) { + assert(code < 0); + callback(); + }; + req.handle = wrap._handle; + + // Close the handle to simulate + wrap.destroy(); + req.handle.shutdown(req); +} + +testShutdown(function() { + done = true; +}); + +process.on('exit', function() { + assert(done); +}); |