diff options
| author | Nicholas Marriott <nicm@openbsd.org> | 2009-10-26 20:47:00 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@openbsd.org> | 2009-10-26 20:47:00 +0000 |
| commit | 353f2a2ad43256b6b1d8c17e3942316d0a8424e2 (patch) | |
| tree | 12f5dbeee73798cc872d8f267dfdfb685b6f52af /server-client.c | |
| parent | 53957dcbaab49362748aa8b25b20e34274b6a3e9 (diff) | |
| download | rtmux-353f2a2ad43256b6b1d8c17e3942316d0a8424e2.tar.gz rtmux-353f2a2ad43256b6b1d8c17e3942316d0a8424e2.tar.bz2 rtmux-353f2a2ad43256b6b1d8c17e3942316d0a8424e2.zip | |
Don't do anything in the client callback if the client has already died to
avoid a use-after-free (the callback is used twice, once for the client itself
and once for the tty). Fixes crashes seen by Han Boetes.
Diffstat (limited to 'server-client.c')
| -rw-r--r-- | server-client.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/server-client.c b/server-client.c index 6d00dd37..5038a036 100644 --- a/server-client.c +++ b/server-client.c @@ -153,6 +153,9 @@ server_client_callback(int fd, int events, void *data) { struct client *c = data; + if (c->flags & CLIENT_DEAD) + return; + if (fd == c->ibuf.fd) { if (events & (POLLERR|POLLNVAL|POLLHUP)) goto client_lost; |