Browse Source
ca_ready_cb and cc_parallel_ready_cb called etcp_connection_close synchronously on non-selected connections from within the ready_cbk callback chain. This corrupts senders_list in topo_group, causing UAF in topo_group_start_link_nat_check. Now uses uasync_call_soon (zero-delay timer) to defer the close to the next event loop iteration, after the callback chain completes and callbacks_running flag is reset.topo_upd
1 changed files with 2 additions and 2 deletions
Loading…
Reference in new issue