Re: Patches for two use-after-free bugs

--000000000000a1593a06493ae7f0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thanks for the guidance, Rodrigo!

Had a better idea on how to fix the socketdata use-after-free; new
attached patch 0002 fixes the bug by only freeing the queued sockdata
if it's exclusively owned by the server queue.

I've added information in the commit summaries as suggested.

I also added an assert in Http_socket_enqueue, which makes explicit
the precondition that socketdata can only be queued to one server at a
time.
This assert has not tripped, and hopefully never will; I thought it
helped illustrate the relation between servers and socketdatas.

Magnus


On Sat, Jan 24, 2026 at 2:10=E2=80=AFPM Rodrigo Arias <[email protected]> =
wrote:
>
> Hi Magnus,
>
> On Sat, Jan 24, 2026 at 11:13:25AM -0800, Nopey Nope wrote:
> >Hello!
> >
> >Find attached two patches, which each fix a use-after-free bug.
> >
> >I've also attached a crashing html document for each, but please be
> >aware that these reproducer documents link urls from external web
> >servers.
> >The reproducers crash reliably on my x86_64 Void Linux laptop, but
> >I've not tested them elsewhere. I've also attached a crash log with
> >asan reporting of each.
> >
> >Thank you
> >-Magnus L
> >
> >p.s. I've also opened github PR 449 with these same changes, but
> >figured I should send the patches via email as well-- if only for
> >practice :)
>
> Thanks a lot for the patches and reproducers!
>
> I saw the PR but I only had time to look at the "Fix use-after-free in
> openssl cert popup" commit which seems good. We are moving away from
> GitHub so it would be nice to send future patches here (or a link to a
> git repo/branch to fetch with git).
>
> It would help to describe what is the condition that triggers the UAF in
> the Http_server patch and why the change helps, so that it is easier to
> review.
>
> Perhaps it would be a good idea to put that information it in the commit
> summary of both patches so we can see it via git blame.
>
> Best,
> Rodrigo.
> _______________________________________________
> Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
> To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]

--000000000000a1593a06493ae7f0
Content-Type: text/x-patch; charset="US-ASCII"; 
	name="0001-Fix-use-after-free-in-openssl-cert-popup.patch"
Content-Disposition: attachment; 
	filename="0001-Fix-use-after-free-in-openssl-cert-popup.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mktcaxs50>
X-Attachment-Id: f_mktcaxs50

RnJvbSAyMzliMGQyZGM3MmM1MjI1MWFjOWNkZjM3MWY0NTY3ZmFhZGVhOWE0IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNYWdudXMgTGFyc2VuIDxnb2xnb3RoYXNUZXJyb3IxMDFAZ21h
aWwuY29tPgpEYXRlOiBUaHUsIDIyIEphbiAyMDI2IDIzOjU3OjI4IC0wODAwClN1YmplY3Q6IFtQ
QVRDSCAxLzJdIEZpeCB1c2UtYWZ0ZXItZnJlZSBpbiBvcGVuc3NsIGNlcnQgcG9wdXAKCkR1cmlu
ZyBUbHNfY29ubmVjdCwgd2UgYWxsb3cgRkxUSyB0byBydW4gY2FsbGJhY2tzIHdoZW4gd2UgcnVu
IHRoZQpjZXJ0aWZpY2F0ZSB2ZXJpZmljYXRpb24gZGlhbG9nLiBTb21lIGNhbGxiYWNrcyBmcmVl
IGNvbm5lY3Rpb25zLCBzdWNoCmFzIE5hdl9yZXB1c2hfY2FsbGJhY2suIFdlIG11c3QgY2hlY2sg
b3VyIGNvbm4gKGlkZW50aWZpZWQgYnkgY29ubmtleSkKaGFzIG5vdCBiZWVuIGZyZWVkIHRodXNs
eSBieSBsb29raW5nIGl0IHVwIGluIHRoZSB2YWxpZF9jb25ucyBrbGlzdApiZWZvcmUgd3JpdGlu
ZyB0byBhbnkgZmllbGRzLgoKVGhlIGNvbm4tPmluX2Nvbm5lY3Qgd3JpdGUgd2FzIG1pc3Npbmcg
c3VjaCBhIGNoZWNrLCBhbmQgc28gd291bGQgd3JpdGUKaW50byBmcmVlZCBtZW1vcnkuIFRoaXMg
d3JpdGUgaXMgc3BlY2lmaWMgdG8gdGhlIHRsc19vcGVuc3NsIHBvcnQsIGFuZApzbyBlbWJlZHRs
cyBpcyBub3QgZWZmZWN0ZWQuCi0tLQogc3JjL0lPL3Rsc19vcGVuc3NsLmMgfCA0ICsrKy0KIDEg
ZmlsZSBjaGFuZ2VkLCAzIGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQg
YS9zcmMvSU8vdGxzX29wZW5zc2wuYyBiL3NyYy9JTy90bHNfb3BlbnNzbC5jCmluZGV4IGRkZGRl
MGU4Li5kZDYxOTk5NiAxMDA2NDQKLS0tIGEvc3JjL0lPL3Rsc19vcGVuc3NsLmMKKysrIGIvc3Jj
L0lPL3Rsc19vcGVuc3NsLmMKQEAgLTEyMTMsOCArMTIxMywxMCBAQCBzdGF0aWMgdm9pZCBUbHNf
Y29ubmVjdChpbnQgZmQsIGludCBjb25ua2V5KQogICAgICogYmVlbiBjbG9zZWQgYnkgdGhlIHNl
cnZlciBpZiB0aGUgdXNlciByZXNwb25kZWQgdG9vIHNsb3dseSB0byBhIHBvcHVwLgogICAgICov
CiAKKyAgIGNvbm4gPSBhX0tsaXN0X2dldF9kYXRhKGNvbm5fbGlzdCwgY29ubmtleSk7CisKICAg
IGlmICghb25nb2luZykgewotICAgICAgaWYgKGFfS2xpc3RfZ2V0X2RhdGEoY29ubl9saXN0LCBj
b25ua2V5KSkgeworICAgICAgaWYgKGNvbm4pIHsKICAgICAgICAgIGNvbm4tPmNvbm5lY3Rpbmcg
PSBGQUxTRTsKICAgICAgICAgIGlmIChmYWlsZWQpIHsKICAgICAgICAgICAgIGNvbm4tPmluX2Nv
bm5lY3QgPSBGQUxTRTsKLS0gCjIuNTEuMgoK
--000000000000a1593a06493ae7f0
Content-Type: text/x-patch; charset="US-ASCII"; 
	name="0002-Fix-premature-SocketData-free-in-Http_server_remove.patch"
Content-Disposition: attachment; 
	filename="0002-Fix-premature-SocketData-free-in-Http_server_remove.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mktcaxsz1>
X-Attachment-Id: f_mktcaxsz1

RnJvbSBmMjMxNzhjMmQ4ZmI5MDNiYzU1Y2MyZmIzODc4N2NlMmNmYjFiMTNlIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNYWdudXMgTGFyc2VuIDxnb2xnb3RoYXNUZXJyb3IxMDFAZ21h
aWwuY29tPgpEYXRlOiBTYXQsIDI0IEphbiAyMDI2IDIwOjA0OjU1IC0wNzAwClN1YmplY3Q6IFtQ
QVRDSCAyLzJdIEZpeCBwcmVtYXR1cmUgU29ja2V0RGF0YSBmcmVlIGluIEh0dHBfc2VydmVyX3Jl
bW92ZQoKU29ja2V0RGF0YSAqIChoZXJlYWZ0ZXIsIFNEKSBhcmUga2VwdCBpbiB0d28gcGxhY2Vz
OiB0aGUgVmFsaWRTb2NrcwprbGlzdCAod2hlcmUgdGhleSBhcmUgYWRkZWQgaW1tZWRpYXRlbHkg
dXBvbiBjcmVhdGlvbiksIGFuZCBzb21ldGltZXMgaW4KYSBTZXJ2ZXJfdCdzIHF1ZXVlIGRsaXN0
LgoKVGhlIGJ1ZyBvY2N1cnMgd2hlbiB0aGUgZm9sbG93aW5nIGV2ZW50cyBoYXBwZW4gaW4gc2Vx
dWVuY2U6CjEuIEh0dHBfc29ja19uZXcgY3JlYXRlcyBhIG5ldyBTRCwgYW5kIGFkZHMgaXQgdG8g
dGhlIFZhbGlkU29ja3MgbGlzdC4KMi4gVGhlIFNEIGlzIHF1ZXVlZCB0byBhIHNlcnZlci4KMy4g
VGhlIHNlcnZlciBpcyByZW1vdmVkIHZpYSBIdHRwX3NlcnZlcl9yZW1vdmUgb3IKICAgSHR0cF9z
ZXJ2ZXJzX3JlbW92ZV9hbGwuIFRoZSBidWdneSBpbXBsZW1lbnRhdGlvbiB1bmNvbmRpdGlvbmFs
bHkKICAgZEZyZWVzIGFsbCBTRCdzIHF1ZXVlZCB0byB0aGUgc2VydmVyLCBsZWF2aW5nIGRhbmds
aW5nIHBvaW50ZXJzIGluCiAgIHRoZSBWYWxpZFNvY2tzIGtsaXN0Lgo0LiBUaGUgU0QncyBTS2V5
IGlzIG5vIGxvbmdlciBuZWVkZWQsIHNvIEh0dHBfc29ja2V0X2ZyZWUgaXMgY2FsbGVkLgogICBI
dHRwX3NvY2tldF9mcmVlIHJlYWRzIHRoZSBTRCBwb2ludGVyIGZyb20gVmFsaWRTb2NrcywgYW5k
IHJlYWRzIHRoZQogICBmbGFncyBmcm9tIHRoZSBkYW5nbGluZyBwb2ludGVyIChrYS1ib29tKS4K
ClRoaXMgY29tbWl0IG1vZGlmaWVzIHN0ZXAgMyB0byBvbmx5IGZyZWUgU0QgdGhhdCBpcyBubyBs
b25nZXIgdmFsaWQgKG5vCmxvbmdlciBpbnNpZGUgb2Yga2xpc3QgVmFsaWRTb2NrcykgYnkgY2hl
Y2tpbmcgZm9yIGZsYWcKSFRUUF9TT0NLRVRfVE9fQkVfRlJFRUQuCi0tLQogc3JjL0lPL2h0dHAu
YyB8IDEyICsrKysrKysrKy0tLQogMSBmaWxlIGNoYW5nZWQsIDkgaW5zZXJ0aW9ucygrKSwgMyBk
ZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvSU8vaHR0cC5jIGIvc3JjL0lPL2h0dHAuYwpp
bmRleCA0ZDk5MDJmMi4uOGVjMDcxNDAgMTAwNjQ0Ci0tLSBhL3NyYy9JTy9odHRwLmMKKysrIGIv
c3JjL0lPL2h0dHAuYwpAQCAtMTA0NSw2ICsxMDQ1LDggQEAgdm9pZCBhX0h0dHBfY2NjKGludCBP
cCwgaW50IEJyYW5jaCwgaW50IERpciwgQ2hhaW5MaW5rICpJbmZvLAogICovCiBzdGF0aWMgdm9p
ZCBIdHRwX3NvY2tldF9lbnF1ZXVlKFNlcnZlcl90ICpzcnYsIFNvY2tldERhdGFfdCogc29jaykK
IHsKKyAgIGFzc2VydCgoInNvY2sgY2Fubm90IGJlbG9uZyB0byBtb3JlIHRoYW4gb25lIHF1ZXVl
IiwgKHNvY2stPmZsYWdzICYgSFRUUF9TT0NLRVRfUVVFVUVEKSA9PSAwKSk7CisKICAgIHNvY2st
PmZsYWdzIHw9IEhUVFBfU09DS0VUX1FVRVVFRDsKIAogICAgaWYgKChzb2NrLT53ZWItPmZsYWdz
ICYgV0VCX0ltYWdlKSA9PSAwKSB7CkBAIC0xMDkyLDcgKzEwOTQsOSBAQCBzdGF0aWMgdm9pZCBI
dHRwX3NlcnZlcl9yZW1vdmUoU2VydmVyX3QgKnNydikKIAogICAgd2hpbGUgKChzZCA9IGRMaXN0
X250aF9kYXRhKHNydi0+cXVldWUsIDApKSkgewogICAgICAgZExpc3RfcmVtb3ZlX2Zhc3Qoc3J2
LT5xdWV1ZSwgc2QpOwotICAgICAgZEZyZWUoc2QpOworICAgICAgc2QtPmZsYWdzICY9IH5IVFRQ
X1NPQ0tFVF9RVUVVRUQ7CisgICAgICBpZiAoc2QtPmZsYWdzICYgSFRUUF9TT0NLRVRfVE9fQkVf
RlJFRUQpCisgICAgICAgICBkRnJlZShzZCk7CiAgICB9CiAgICBkTGlzdF9mcmVlKHNydi0+cXVl
dWUpOwogICAgZExpc3RfcmVtb3ZlX2Zhc3Qoc2VydmVycywgc3J2KTsKQEAgLTExMDgsOCArMTEx
MiwxMCBAQCBzdGF0aWMgdm9pZCBIdHRwX3NlcnZlcnNfcmVtb3ZlX2FsbCh2b2lkKQogICAgd2hp
bGUgKGRMaXN0X2xlbmd0aChzZXJ2ZXJzKSA+IDApIHsKICAgICAgIHNydiA9IChTZXJ2ZXJfdCop
IGRMaXN0X250aF9kYXRhKHNlcnZlcnMsIDApOwogICAgICAgd2hpbGUgKChzZCA9IGRMaXN0X250
aF9kYXRhKHNydi0+cXVldWUsIDApKSkgewotICAgICAgICAgZExpc3RfcmVtb3ZlKHNydi0+cXVl
dWUsIHNkKTsKLSAgICAgICAgIGRGcmVlKHNkKTsKKyAgICAgICAgIGRMaXN0X3JlbW92ZV9mYXN0
KHNydi0+cXVldWUsIHNkKTsKKyAgICAgICAgIHNkLT5mbGFncyAmPSB+SFRUUF9TT0NLRVRfUVVF
VUVEOworICAgICAgICAgaWYgKHNkLT5mbGFncyAmIEhUVFBfU09DS0VUX1RPX0JFX0ZSRUVEKQor
ICAgICAgICAgICAgZEZyZWUoc2QpOwogICAgICAgfQogICAgICAgSHR0cF9zZXJ2ZXJfcmVtb3Zl
KHNydik7CiAgICB9Ci0tIAoyLjUxLjIKCg==
--000000000000a1593a06493ae7f0
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]

--000000000000a1593a06493ae7f0--