35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From: RafaelGSS <rafael.nunu@hotmail.com>
|
|
Date: Tue, 26 Mar 2024 15:55:13 -0300
|
|
Subject: CVE-2024-27983 ensure to close stream when destroying session
|
|
|
|
Co-Authored-By: Anna Henningsen <anna@addaleax.net>
|
|
PR-URL: https://github.com/nodejs-private/node-private/pull/561
|
|
bug-hakerone: https://hackerone.com/reports/2319584
|
|
Reviewed-By: Michael Dawson <midawson@redhat.com>
|
|
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
|
|
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
|
|
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
|
|
CVE-ID: CVE-2024-27983
|
|
origin: backport, https://github.com/nodejs/node/commit/0fb816dbccde955cd24acc1b16497a91fab507c8.patch
|
|
---
|
|
src/node_http2.cc | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/node_http2.cc b/src/node_http2.cc
|
|
index 5156aa3..c441921 100644
|
|
--- a/src/node_http2.cc
|
|
+++ b/src/node_http2.cc
|
|
@@ -590,6 +590,12 @@ Http2Session::Http2Session(Environment* env,
|
|
Http2Session::~Http2Session() {
|
|
CHECK_EQ(flags_ & SESSION_STATE_HAS_SCOPE, 0);
|
|
Debug(this, "freeing nghttp2 session");
|
|
+ // Ensure that all `Http2Stream` instances and the memory they hold
|
|
+ // on to are destroyed before the nghttp2 session is.
|
|
+ for (const auto& [id, stream] : streams_) {
|
|
+ stream->Detach();
|
|
+ }
|
|
+ streams_.clear();
|
|
nghttp2_session_del(session_);
|
|
CHECK_EQ(current_nghttp2_memory_, 0);
|
|
}
|