d3v1l/matrixion
1
0
Fork 0
mirror of https://github.com/Nheko-Reborn/nheko.git synced 2024-11-25 20:48:52 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix double free by closing cursor at the right time

Browse source
This commit is contained in:
Nicolas Werner 2020-07-30 18:13:19 +02:00
parent 12090c0a06
commit 7f3d97517f
1 changed files with 33 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/Cache.cpp
View file

@ -2199,6 +2199,7 @@ Cache::firstPendingMessage(const std::string &room_id)
auto txn = lmdb::txn::begin(env_); auto txn = lmdb::txn::begin(env_);
auto pending = getPendingMessagesDb(txn, room_id); auto pending = getPendingMessagesDb(txn, room_id);
{
auto pendingCursor = lmdb::cursor::open(txn, pending); auto pendingCursor = lmdb::cursor::open(txn, pending);
lmdb::val tsIgnored, pendingTxn; lmdb::val tsIgnored, pendingTxn;
while (pendingCursor.get(tsIgnored, pendingTxn, MDB_NEXT)) { while (pendingCursor.get(tsIgnored, pendingTxn, MDB_NEXT)) {
@ -2214,14 +2215,17 @@ Cache::firstPendingMessage(const std::string &room_id)
mtx::events::collections::from_json( mtx::events::collections::from_json(
json::parse(std::string_view(event.data(), event.size())), te); json::parse(std::string_view(event.data(), event.size())), te);
pendingCursor.close();
txn.commit(); txn.commit();
return te; return te;
} catch (std::exception &e) { } catch (std::exception &e) {
nhlog::db()->error("Failed to parse message from cache {}", e.what()); nhlog::db()->error("Failed to parse message from cache {}",
e.what());
lmdb::dbi_del(txn, pending, tsIgnored, pendingTxn); lmdb::dbi_del(txn, pending, tsIgnored, pendingTxn);
continue; continue;
} }
} }
}
txn.commit(); txn.commit();
@ -2233,12 +2237,15 @@ Cache::removePendingStatus(const std::string &room_id, const std::string &txn_id
{ {
auto txn = lmdb::txn::begin(env_); auto txn = lmdb::txn::begin(env_);
auto pending = getPendingMessagesDb(txn, room_id); auto pending = getPendingMessagesDb(txn, room_id);
{
auto pendingCursor = lmdb::cursor::open(txn, pending); auto pendingCursor = lmdb::cursor::open(txn, pending);
lmdb::val tsIgnored, pendingTxn; lmdb::val tsIgnored, pendingTxn;
while (pendingCursor.get(tsIgnored, pendingTxn, MDB_NEXT)) { while (pendingCursor.get(tsIgnored, pendingTxn, MDB_NEXT)) {
if (std::string_view(pendingTxn.data(), pendingTxn.size()) == txn_id) if (std::string_view(pendingTxn.data(), pendingTxn.size()) == txn_id)
lmdb::cursor_del(pendingCursor); lmdb::cursor_del(pendingCursor);
} }
}
txn.commit(); txn.commit();
} }