Project

General

Profile

Actions
Copy link

Bug #14136

closed
AD RM

Heap-use-after-free in HTTP keep-alive connection handling

Bug #14136: Heap-use-after-free in HTTP keep-alive connection handling

Added by Aleksei Davydov 11 months ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Romain Mardulyn
Target version:
4.12.3
Start date:
11/24/2025
Due date:
% Done:

0%

Estimated time:

Description

Heap-use-after-free was found with ASAN on client disconnect during fuzz-testing with raw TCP packats (AFL++).

PR with fix proposal and details on GitHub: https://github.com/emweb/wt/pull/235

Trigger Scenario

  1. Client sends an HTTP request
  2. Server processes it and starts sending response
  3. Client closes connection
  4. handleWriteResponse() is called to clean up for next keep-alive request
  5. rcv_remaining_ points to a deleted buffer → heap-use-after-free in RequestParser::consume()

ASAN Report (first line)
==8==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000000306
READ of size 1 at 0x625000000306 thread T4
#0 in http::server::RequestParser::consume() RequestParser.C:857

Please check Github PR for more info

RM Updated by Romain Mardulyn 8 months ago Actions
Copy link
 #1

  • Status changed from New to InProgress
  • Assignee set to Romain Mardulyn
  • Target version set to 4.12.4

RM Updated by Romain Mardulyn 8 months ago Actions
Copy link
 #2

  • Status changed from InProgress to Review
  • Assignee deleted (Romain Mardulyn)

MV Updated by Matthias Van Ceulebroeck 8 months ago Actions
Copy link
 #3

  • Assignee set to Matthias Van Ceulebroeck

RM Updated by Romain Mardulyn 8 months ago Actions
Copy link
 #4

  • Status changed from Review to Implemented @Emweb
  • Assignee changed from Matthias Van Ceulebroeck to Romain Mardulyn
  • Private changed from No to Yes

RM Updated by Romain Mardulyn 8 months ago Actions
Copy link
 #5

  • Target version changed from 4.12.4 to 4.12.3

RM Updated by Romain Mardulyn 8 months ago Actions
Copy link
 #6

  • Status changed from Implemented @Emweb to Closed
  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom