From a282b339504380bd2b1d705720ea2de757ae5541 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 20:23:15 +0100 Subject: If an inline handler closed the connection on error, the cookie may have become invalid. Stop processing then --- src/ot_tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src') diff --git a/src/ot_tcp.c b/src/ot_tcp.c index f93795b..5d7b78f 100644 --- a/src/ot_tcp.c +++ b/src/ot_tcp.c @@ -45,6 +45,7 @@ static ssize_t header_complete(char *request, ssize_t byte_count) { void tcp_read(const int64_t sock, struct ot_workstruct *ws) { struct http_data *cookie = fdstate_cookie(sock); ssize_t byte_count = read((int)sock, ws->inbuf, G_INBUF_SIZE); + uint32_t generation; if (byte_count == 0 || (byte_count == -1 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) { http_close(sock); @@ -75,6 +76,7 @@ void tcp_read(const int64_t sock, struct ot_workstruct *ws) { return; } + generation = fdstate_generation((int)sock); while ((ws->header_size = header_complete(cookie->request.data, (ssize_t)cookie->request.size))) { ws->request = cookie->request.data; ws->request_size = (ssize_t)cookie->request.size; @@ -84,6 +86,11 @@ void tcp_read(const int64_t sock, struct ot_workstruct *ws) { off it, so there is nothing here left to look at */ if (ws->handed_off) return; + + /* The handler may have closed the connection inline, for instance on a + write error, which frees the cookie this loop reads from */ + if (fdstate_generation((int)sock) != generation) + return; #ifdef WANT_KEEPALIVE if (!ws->keep_alive) #endif -- cgit v1.3