mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-03-27 19:33:06 -04:00
Code Issues Packages Projects Releases Wiki Activity

common: Add thread safety on libcurl usage

Browse Source 
There can happen a race condition between internal libcurl structure
content when two threads set the `data` structure for the callbacks
from two threads, which can cause access of already freed stack-allocated
`data`, resulting in a memory corruption.

Closes https://github.com/flatpak/flatpak/issues/3701
This commit is contained in:
Milan Crha
2022-08-16 15:22:39 +02:00
committed by Alexander Larsson
parent 764e5a4d0c
commit dc82a19dc5
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
common/flatpak-utils-http.c
View File

@@ -243,6 +243,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC (auto_curl_slist, curl_slist_free_all)
struct FlatpakHttpSession {
CURL *curl;
GMutex lock;
};
static void
@@ -369,6 +370,8 @@ flatpak_create_http_session (const char *user_agent)
session->curl = curl = curl_easy_init();
g_assert (session->curl != NULL);
g_mutex_init (&session->lock);
curl_easy_setopt (curl, CURLOPT_USERAGENT, user_agent);
rc = curl_easy_setopt (curl, CURLOPT_PROTOCOLS, (long)(CURLPROTO_HTTP | CURLPROTO_HTTPS));
g_assert_cmpint (rc, ==, CURLM_OK);
@@ -406,7 +409,10 @@ flatpak_create_http_session (const char *user_agent)
void
flatpak_http_session_free (FlatpakHttpSession* session)
{
g_mutex_lock (&session->lock);
curl_easy_cleanup (session->curl);
g_mutex_unlock (&session->lock);
g_mutex_clear (&session->lock);
g_free (session);
}
@@ -447,6 +453,7 @@ flatpak_download_http_uri_once (FlatpakHttpSession *session,
g_autofree char *auth_header = NULL;
g_autofree char *cache_header = NULL;
g_autoptr(auto_curl_slist) header_list = NULL;
g_autoptr(GMutexLocker) curl_lock = g_mutex_locker_new (&session->lock);
long response;
CURL *curl = session->curl;
@@ -541,6 +548,9 @@ flatpak_download_http_uri_once (FlatpakHttpSession *session,
g_debug ("Received %" G_GUINT64_FORMAT " bytes", data->downloaded_bytes);
/* This is not really needed, but the auto-pointer confuses some compilers in the CI */
g_clear_pointer (&curl_lock, g_mutex_locker_free);
return TRUE;
}