GithubStar/open62541
1
0
Fork 0
mirror of https://github.com/open62541/open62541.git synced 2026-10-17 04:42:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): Clear staged async queue links

Browse Source 
TAILQ_REMOVE leaves intrusive link fields unchanged in release builds. Clear both links before invoking cancellation callbacks so stack-local staging queue addresses cannot escape through retained operations.
This commit is contained in:
Julius Pfrommer
2026-08-30 17:49:52 +02:00
committed by Julius Pfrommer
parent f9eb7a4a2a
commit 437995bc22
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/ua_server_async.c
+8
View File
@@ -424,6 +424,10 @@ UA_AsyncManager_cancelSession(UA_Server *server, const UA_NodeId *sessionId,
while((op = TAILQ_FIRST(&canceledOps))) {
TAILQ_REMOVE(&canceledOps, op, pointers);
/* TAILQ_REMOVE does not clear the links in release builds. Avoid
* retaining the stack-local queue head across the callback. */
op->pointers.tqe_next = NULL;
op->pointers.tqe_prev = NULL;
UA_AsyncOperation_cancel(server, op, status);
}
@@ -575,6 +579,10 @@ cancelAsyncResponseOperations(UA_Server *server, UA_AsyncResponse *ar,
* cancellation callback may reenter and mutate the waiting queue. */
while((op = TAILQ_FIRST(&canceledOps))) {
TAILQ_REMOVE(&canceledOps, op, pointers);
/* TAILQ_REMOVE does not clear the links in release builds. Avoid
* retaining the stack-local queue head across the callback. */
op->pointers.tqe_next = NULL;
op->pointers.tqe_prev = NULL;
UA_AsyncOperation_cancel(server, op, status);
}
}