From: José Bollo <jose.bollo@iot.bzh>
Date: Thu, 15 Mar 2018 14:34:59 +0000 (+0100)
Subject: afb-websock: Fix a double free
X-Git-Tag: flounder_5.99.1~43
X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=commitdiff_plain;h=428dd77c7ef528dd1769d7c9bb95cd0fb2eaf2a8;p=src%2Fapp-framework-binder.git

afb-websock: Fix a double free

The commit 0ebdff94d461abd4328cf45a6281c15139a045eb of
libmicrohttpd fixed a bug but introduced a double free
of hreq resource attached to the connection. That commit
is between versions 0.9.59 and 0.9.60 of libmicrohttpd.

Now, hreq is freed in 'end_handler' of afb-hsrv.c

Change-Id: Ia865d65c5f9ef5ce787eb6545802ac8ea37ae468
Signed-off-by: José Bollo <jose.bollo@iot.bzh>
---

diff --git a/src/afb-client-demo.c b/src/afb-client-demo.c
index b41021ab..a784bdb7 100644
--- a/src/afb-client-demo.c
+++ b/src/afb-client-demo.c
@@ -79,6 +79,7 @@ static struct afb_proto_ws_client_itf pws_itf = {
 /* global variables */
 static struct afb_wsj1 *wsj1;
 static struct afb_proto_ws *pws;
+static int breakcon;
 static int exonrep;
 static int callcount;
 static int human;
@@ -92,8 +93,8 @@ static void usage(int status, char *arg0)
 {
 	char *name = strrchr(arg0, '/');
 	name = name ? name + 1 : arg0;
-	fprintf(status ? stderr : stdout, "usage: %s [-H [-r]] uri [api verb [data]]\n", name);
-	fprintf(status ? stderr : stdout, "       %s -d [-H [-r]] uri [verb [data]]\n", name);
+	fprintf(status ? stderr : stdout, "usage: %s [-H [-r]] [-b] uri [api verb [data]]\n", name);
+	fprintf(status ? stderr : stdout, "       %s -d [-H [-r]] [-b] uri [verb [data]]\n", name);
 	exit(status);
 }
 
@@ -121,6 +122,9 @@ int main(int ac, char **av, char **env)
 			else if (!strcmp(av[1], "--direct")) /* request for direct api */
 				direct = 1;
 
+			else if (!strcmp(av[1], "--break")) /* request to break connection */
+				breakcon = 1;
+
 			/* emit usage and exit */
 			else
 				usage(!!strcmp(av[1], "--help"), a0);
@@ -131,6 +135,7 @@ int main(int ac, char **av, char **env)
 				case 'H': human = 1; break;
 				case 'r': raw = 1; break;
 				case 'd': direct = 1; break;
+				case 'b': breakcon = 1; break;
 				default: usage(av[1][rc] != 'h', a0);
 				}
 		}
@@ -286,6 +291,8 @@ static void wsj1_emit(const char *api, const char *verb, const char *object)
 		wsj1_event(verb, object);
 	else
 		wsj1_call(api, verb, object);
+	if (breakcon)
+		exit(0);
 }
 
 /* called when something happens on stdin */
@@ -456,6 +463,8 @@ static void pws_call(const char *verb, const char *object)
 		fprintf(stderr, "calling %s(%s) failed: %m\n", verb, object?:"");
 		dec_callcount();
 	}
+	if (breakcon)
+		exit(0);
 }
 
 /* called when pws hangsup */
diff --git a/src/afb-websock.c b/src/afb-websock.c
index fdfca9d7..51234378 100644
--- a/src/afb-websock.c
+++ b/src/afb-websock.c
@@ -158,7 +158,9 @@ static void upgrade_to_websocket(
 			close_websocket(urh);
 		}
 	}
+#if MHD_VERSION <= 0x00095900
 	afb_hreq_unref(memo->hreq);
+#endif
 	free(memo);
 }