mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
inspector: fix crash when writing to closed inspector socket
ProtocolHandler::WriteRaw() dereferences tcp_ without a null check. When the remote end disconnects, OnEof() resets tcp_ to nullptr, but queued messages from the uv_async callback can still trigger Write() on the same event loop iteration, causing a null pointer dereference crash (EXCEPTION_ACCESS_VIOLATION on Windows). Additionally, ParseWsFrames() can call OnEof() internally (on compressed or error frames), which resets tcp_ mid-loop in OnData(). If the delegate callback triggered by OnWsFrame() then calls Write(), it would also hit the null tcp_ crash. Add null guards in: - WsHandler::OnData: stop parsing loop when tcp_ becomes null - WsHandler::Write: early return before frame encoding - ProtocolHandler::WriteRaw: defensive fallback for all write paths Fixes: https://github.com/nodejs/node/issues/34833 Signed-off-by: piaoyingmin <piaoyingmin@bytedance.com> PR-URL: https://github.com/nodejs/node/pull/64209 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
This commit is contained in:
1 parent
90fbf0ec0a
commit
8a84e6be90
1 file changed
+3
-1
@@ -401,10 +401,11 @@ class WsHandler : public ProtocolHandler {
|
||||
if (processed > 0) {
|
||||
remove_from_beginning(data, processed);
|
||||
}
|
||||
} while (processed > 0 && !data->empty());
|
||||
} while (processed > 0 && !data->empty() && tcp_);
|
||||
}
|
||||
|
||||
void Write(const std::vector<char> data) override {
|
||||
if (!tcp_) return;
|
||||
std::vector<char> output = encode_frame_hybi17(data);
|
||||
WriteRaw(output, WriteRequest::Cleanup);
|
||||
}
|
||||
@@ -666,6 +667,7 @@ ProtocolHandler::ProtocolHandler(InspectorSocket* inspector,
|
||||
|
||||
int ProtocolHandler::WriteRaw(const std::vector<char>& buffer,
|
||||
uv_write_cb write_cb) {
|
||||
if (!tcp_) return -1;
|
||||
return tcp_->WriteRaw(buffer, write_cb);
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user