[trafficserver] branch 7.1.x updated: heap use after free

[zwoop]

This is an automated email from the ASF dual-hosted git repository.

zwoop pushed a commit to branch 7.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/7.1.x by this push:
     new a0893b9  heap use after free
a0893b9 is described below

commit a0893b99a0bc46ca58be602248160eb354a80dec
Author: Fei Deng <duke8...@gmail.com>
AuthorDate: Wed Sep 12 10:03:19 2018 -0500

    heap use after free
    
    (cherry picked from commit 480ba87c17badad20a20d85f88c8a992b893cfe0)
---
 proxy/http/HttpTransact.cc | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/proxy/http/HttpTransact.cc b/proxy/http/HttpTransact.cc
index ace91d8..2d66998 100644
--- a/proxy/http/HttpTransact.cc
+++ b/proxy/http/HttpTransact.cc
@@ -8573,7 +8573,12 @@ HttpTransact::client_result_stat(State *s, ink_hrtime 
total_time, ink_hrtime req
   ///////////////////////////////////////////////////////
   // don't count errors we generated as hits or misses //
   ///////////////////////////////////////////////////////
-  if ((s->source == SOURCE_INTERNAL) && 
(s->hdr_info.client_response.status_get() >= 400)) {
+  int client_response_status = HTTP_STATUS_NONE;
+  if (s->hdr_info.client_response.valid()) {
+    client_response_status = s->hdr_info.client_response.status_get();
+  }
+
+  if ((s->source == SOURCE_INTERNAL) && client_response_status >= 400) {
     client_transaction_result = CLIENT_TRANSACTION_RESULT_ERROR_OTHER;
   }
 
@@ -8668,9 +8673,7 @@ HttpTransact::client_result_stat(State *s, ink_hrtime 
total_time, ink_hrtime req
   }
   // Count the status codes, assuming the client didn't abort (i.e. there is 
an m_http)
   if ((s->source != SOURCE_NONE) && (s->client_info.abort == DIDNOT_ABORT)) {
-    int status_code = s->hdr_info.client_response.status_get();
-
-    switch (status_code) {
+    switch (client_response_status) {
     case 100:
       HTTP_INCREMENT_DYN_STAT(http_response_status_100_count_stat);
       break;
@@ -8791,7 +8794,7 @@ HttpTransact::client_result_stat(State *s, ink_hrtime 
total_time, ink_hrtime req
     default:
       break;
     }
-    switch (status_code / 100) {
+    switch (client_response_status / 100) {
     case 1:
       HTTP_INCREMENT_DYN_STAT(http_response_status_1xx_count_stat);
       break;