1 files changed, 27 insertions, 14 deletions

diff --git a/ot_http.c b/ot_http.c
index dcf634f..46ca5a9 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -44,7 +44,7 @@ ssize_t      g_stats_path_len;
 
 enum { SUCCESS_HTTP_HEADER_LENGTH = 80, SUCCESS_HTTP_SIZE_OFF = 17 };
 
-static void http_senddata(const int64 sock, struct ot_workstruct *ws) {
+static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
   struct http_data *cookie = io_getcookie(sock);
   ssize_t           written_size;
 
@@ -124,7 +124,7 @@ static void http_senddata(const int64 sock, struct ot_workstruct *ws) {
 #define HTTPERROR_403_IP         return http_issue_error(sock, ws, CODE_HTTPERROR_403_IP)
 #define HTTPERROR_404            return http_issue_error(sock, ws, CODE_HTTPERROR_404)
 #define HTTPERROR_500            return http_issue_error(sock, ws, CODE_HTTPERROR_500)
-ssize_t http_issue_error(const int64 sock, struct ot_workstruct *ws, int code) {
+ssize_t http_issue_error(const int64_t sock, struct ot_workstruct *ws, int code) {
   char *error_code[] = {"302 Found",      "400 Invalid Request", "400 Invalid Request", "400 Invalid Request",      "402 Payment Required",
                         "403 Not Modest", "403 Access Denied",   "404 Not Found",       "500 Internal Server Error"};
   char *title        = error_code[code];
@@ -144,7 +144,7 @@ ssize_t http_issue_error(const int64 sock, struct ot_workstruct *ws, int code) {
   return ws->reply_size = -2;
 }
 
-ssize_t http_sendiovecdata(const int64 sock, struct ot_workstruct *ws, size_t iovec_entries, struct iovec *iovector, int is_partial) {
+ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t iovec_entries, struct iovec *iovector, int is_partial) {
   struct http_data *cookie = io_getcookie(sock);
   io_batch         *current;
   char             *header;
@@ -158,6 +158,13 @@ ssize_t http_sendiovecdata(const int64 sock, struct ot_workstruct *ws, size_t io
     HTTPERROR_500;
   }
 
+  /* Descriptor numbers get recycled, so a result can only belong to this
+     connection if this connection is in fact waiting for one. */
+  if (!(cookie->flag & (STRUCT_HTTP_FLAG_WAITINGFORTASK | STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER))) {
+    iovec_free(&iovec_entries, &iovector);
+    return 0;
+  }
+
   /* If this socket collected request in a buffer, free it now */
   buf_reset(&cookie->request);
 
@@ -236,7 +243,7 @@ ssize_t http_sendiovecdata(const int64 sock, struct ot_workstruct *ws, size_t io
   return 0;
 }
 
-static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, char *read_ptr) {
+static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   static const ot_keywords keywords_main[] = {{"mode", 1}, {"format", 2}, {"info_hash", 3}, {NULL, -3}};
   static const ot_keywords keywords_mode[] = {{"peer", TASK_STATS_PEERS},
                                               {"conn", TASK_STATS_CONNS},
@@ -267,12 +274,16 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
                                                 {"url", TASK_FULLSCRAPE_TPB_URLENCODED},  {"txt", TASK_FULLSCRAPE_TPB_ASCII},
                                                 {"txtp", TASK_FULLSCRAPE_TPB_ASCII_PLUS}, {NULL, -3}};
 
-  int mode = TASK_STATS_PEERS, scanon = 1, format = 0;
-
-#ifdef WANT_RESTRICT_STATS
   struct http_data *cookie = io_getcookie(sock);
+  int               mode = TASK_STATS_PEERS, scanon = 1, format = 0;
 
-  if (!cookie || !accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_STAT))
+  /* A socket without one is a dead socket, which is what http_sendiovecdata
+     already answers 500 to. */
+  if (!cookie)
+    HTTPERROR_500;
+
+#ifdef WANT_RESTRICT_STATS
+  if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_STAT))
     HTTPERROR_403_IP;
 #endif
 
@@ -306,8 +317,7 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
   }
 
   if (mode == TASK_STATS_TPB) {
-    struct http_data *cookie = io_getcookie(sock);
-    tai6464           t;
+    tai6464 t;
 #ifdef WANT_COMPRESSION_GZIP
     ws->request[ws->request_size - 1] = 0;
 #ifndef WANT_COMPRESSION_GZIP_ALWAYS
@@ -334,6 +344,9 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
   /* default format for now */
   if ((mode & TASK_CLASS_MASK) == TASK_STATS) {
     tai6464 t;
+
+    cookie->flag |= STRUCT_HTTP_FLAG_WAITINGFORTASK;
+
     /* Complex stats also include expensive memory debugging tools */
     taia_uint(&t, 0);
     io_timeout(sock, t);
@@ -355,7 +368,7 @@ typedef struct {
 #endif
 
 #ifdef WANT_FULLSCRAPE
-static ssize_t http_handle_fullscrape(const int64 sock, struct ot_workstruct *ws) {
+static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *ws) {
   struct http_data *cookie = io_getcookie(sock);
   int               format = 0;
   tai6464           t;
@@ -425,7 +438,7 @@ static ssize_t http_handle_fullscrape(const int64 sock, struct ot_workstruct *ws
 }
 #endif
 
-static ssize_t http_handle_scrape(const int64 sock, struct ot_workstruct *ws, char *read_ptr) {
+static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   static const ot_keywords keywords_scrape[] = {{"info_hash", 1}, {NULL, -3}};
 
   ot_hash *multiscrape_buf   = (ot_hash *)ws->request;
@@ -504,7 +517,7 @@ static ot_keywords keywords_announce[] = {{"port", 1},    {"left", 2}, {"event",
 #endif
                                           {"peer_id", 9}, {NULL, -3}};
 static ot_keywords keywords_announce_event[] = {{"completed", 1}, {"stopped", 2}, {NULL, -3}};
-static ssize_t     http_handle_announce(const int64 sock, struct ot_workstruct *ws, char *read_ptr) {
+static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   size_t            numwant;
   int               tmp, scanon;
   unsigned short    port = 0;
@@ -682,7 +695,7 @@ static ssize_t     http_handle_announce(const int64 sock, struct ot_workstruct *
   return ws->reply_size;
 }
 
-ssize_t http_handle_request(const int64 sock, struct ot_workstruct *ws) {
+ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   ssize_t reply_off, len;
   char   *read_ptr = ws->request, *write_ptr;