Copilot commented on code in PR #13881:
URL: https://github.com/apache/trafficserver/pull/13881#discussion_r4339191401
##########
src/iocore/dns/DNS.cc:
##########
@@ -1516,9 +1516,8 @@ DNSEntry::post(DNSHandler *h, HostEnt *ent)
int
DNSEntry::postOneEvent(int /* event ATS_UNUSED */, Event * /* e ATS_UNUSED */)
{
- if (!action.cancelled) {
+ if (action.call_back(DNS_EVENT_LOOKUP, result_ent.get())) {
Dbg(dbg_ctl_dns, "called back continuation for %s", qname);
- action.continuation->handleEvent(DNS_EVENT_LOOKUP, result_ent.get());
}
result_ent = nullptr;
action.mutex = nullptr;
Review Comment:
`Action::call_back` explicitly documents that the handler may destroy the
`Action` (and potentially the owning object), but this function continues to
access `qname`, `result_ent`, and `action.mutex` after invoking `call_back`.
This creates a concrete use-after-free risk. Restructure so no members are
accessed after `call_back` (e.g., move any needed state into locals and perform
cleanup before the callback, or return immediately after the callback and
ensure ownership/cleanup is handled safely).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
