From 79f4110365fe85f4377c50f0893134a8d5e45575 Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Fri, 30 Oct 2026 01:00:52 +0100
Subject: Consolidate all tcp/http tear down into a single http_close function
 to prevent a rare UAF for expiring connections

---
 opentracker.c | 27 +++++----------------------
 1 file changed, 5 insertions(+), 22 deletions(-)

(limited to 'opentracker.c')

diff --git a/opentracker.c b/opentracker.c
index e0f16d7..6160696 100644
--- a/opentracker.c
+++ b/opentracker.c
@@ -115,29 +115,12 @@ static ssize_t header_complete(char *request, ssize_t byte_count) {
   return 0;
 }
 
-static void handle_dead(const int64_t sock) {
-  struct http_data *cookie = fdstate_cookie(sock);
-  if (cookie) {
-    if (cookie->batch)
-      batch_reset(cookie->batch);
-    free(cookie->batch);
-    buf_reset(&cookie->request);
-    if (cookie->flag & (STRUCT_HTTP_FLAG_WAITINGFORTASK | STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER))
-      mutex_workqueue_canceltask(sock);
-    free(cookie);
-  }
-  /* The generation has to move before the kernel can reissue the number */
-  fdstate_close(sock);
-  event_del((int)sock);
-  close((int)sock);
-}
-
 static void handle_read(const int64_t sock, struct ot_workstruct *ws) {
   struct http_data *cookie     = fdstate_cookie(sock);
   ssize_t           byte_count = read((int)sock, ws->inbuf, G_INBUF_SIZE);
 
   if (byte_count == 0 || (byte_count == -1 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) {
-    handle_dead(sock);
+    http_close(sock);
     return;
   }
 
@@ -156,7 +139,7 @@ static void handle_read(const int64_t sock, struct ot_workstruct *ws) {
       ws->request_size = byte_count;
       http_handle_request(sock, ws);
     } else if (buf_cat(&cookie->request, ws->inbuf, (size_t)byte_count))
-      handle_dead(sock);
+      http_close(sock);
     return;
   }
 
@@ -187,7 +170,7 @@ static void handle_write(const int64_t sock) {
 
     if (cookie->batch) {
       if (batch_send(sock, cookie->batch) == BATCH_FAILED) {
-        handle_dead(sock);
+        http_close(sock);
         return;
       }
       if (batch_pending(cookie->batch))
@@ -205,7 +188,7 @@ static void handle_write(const int64_t sock) {
     http_interest_add(sock, cookie, EVENT_IN);
     fdstate_set_expiry(sock, time_future_seconds(OT_CLIENT_TIMEOUT));
   } else
-    handle_dead(sock);
+    http_close(sock);
 }
 
 static void handle_accept(const int64_t serversocket, struct ot_workstruct *ws) {
@@ -303,7 +286,7 @@ static void *server_mainloop(void *args) {
       int cursor = 0;
 
       while ((sock = fdstate_next_expired(time_now_seconds(), &cursor)) != -1)
-        handle_dead(sock);
+        http_close(sock);
       next_timeout_check = time_future_seconds(OT_CLIENT_TIMEOUT_CHECKINTERVAL);
     }
 
-- 
cgit v1.3