commit fd5de11497edd7cdb28e7eef60fa998a2ebd7f84
author Davide Pesavento <davide.pesavento@lip6.fr> Sat Oct 24 01:47:10 2015 +0200
committer Davide Pesavento <davide.pesavento@lip6.fr> Wed Oct 28 02:54:36 2015 +0100
tree 16534dc3614bccd3c86ed1b45e1c46f0108d23e3
parent a2de7e4eab3d428e5344c7c2b3979a2a4e90a6a1

util: fix heap-use-after-free in ndn::dns::Resolver

Change-Id: I063edba1b895da36ed4a17a0558e5df820b785a7
Refs: #2653

src/util/dns.cpp

diff --git a/src/util/dns.cpp b/src/util/dns.cpp
index 0aebc3a..0adfbd2 100644
--- a/src/util/dns.cpp
+++ b/src/util/dns.cpp
@@ -70,6 +70,8 @@
                   iterator it, const shared_ptr<Resolver>& self)
   {
     m_scheduler.cancelEvent(m_resolveTimeout);
+    // ensure the Resolver isn't destructed while callbacks are still pending, see #2653
+    m_resolver.get_io_service().post(bind([] (const shared_ptr<Resolver>&) {}, self));
 
     if (error) {
       if (error == boost::asio::error::operation_aborted)
@@ -95,6 +97,8 @@
   onResolveTimeout(const shared_ptr<Resolver>& self)
   {
     m_resolver.cancel();
+    // ensure the Resolver isn't destructed while callbacks are still pending, see #2653
+    m_resolver.get_io_service().post(bind([] (const shared_ptr<Resolver>&) {}, self));
 
     if (m_onError)
       m_onError("Hostname resolution timed out");