0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

campaignd: fix use-after-free when sending an add-on on Windows

Browse source 
This fixes the add-on size being reported as 3,7 gigabytes
(magic number 0xFEEEFEEE that means freed heap memory).
This commit is contained in:
Jyrki Vesterinen 2017-03-07 20:55:48 +02:00
parent ceee890397
commit a6ba521a5e
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/server/send_receive_wml_helpers.ipp
View file

@ -31,6 +31,7 @@
#include "simple_wml.hpp"
#include "filesystem.hpp"
#include <memory>
#include <stdexcept>
template<typename Handler, typename ErrorHandler>
@ -178,6 +179,7 @@ struct sendfile_op
Handler handler_;
ErrorHandler error_handler_;
bool pending_;
std::shared_ptr<handle_doc<Handler, ErrorHandler>> handle_send_doc_;
void operator()(boost::system::error_code ec, std::size_t)
{
@ -255,9 +257,9 @@ void async_send_file(socket_ptr socket, const std::string& filename, Handler han
}
op.overlap_.hEvent = event;
op.handle_send_doc_.reset(new handle_doc<Handler, ErrorHandler>(socket, handler, error_handler, filesize, nullptr));
handle_doc<Handler, ErrorHandler> handle_send_doc(socket, handler, error_handler, filesize, nullptr);
buffers.push_back(boost::asio::buffer(handle_send_doc.data_size->buf, 4));
buffers.push_back(boost::asio::buffer(op.handle_send_doc_->data_size->buf, 4));
async_write(*socket, buffers, op);
}