inspector: fix crash when writing to closed inspector socket#64209
Open
Yayapapa wants to merge 1 commit into
Open
inspector: fix crash when writing to closed inspector socket#64209Yayapapa wants to merge 1 commit into
Yayapapa wants to merge 1 commit into
Conversation
Collaborator
|
Review requested:
|
ProtocolHandler::WriteRaw() dereferences tcp_ without a null check. When the remote end disconnects, OnEof() resets tcp_ to nullptr, but queued messages from the uv_async callback can still trigger Write() on the same event loop iteration, causing a null pointer dereference crash (EXCEPTION_ACCESS_VIOLATION on Windows). Additionally, ParseWsFrames() can call OnEof() internally (on compressed or error frames), which resets tcp_ mid-loop in OnData(). If the delegate callback triggered by OnWsFrame() then calls Write(), it would also hit the null tcp_ crash. Add null guards in: - WsHandler::OnData: stop parsing loop when tcp_ becomes null - WsHandler::Write: early return before frame encoding - ProtocolHandler::WriteRaw: defensive fallback for all write paths Fixes: nodejs#34833
6b24974 to
fce2dc8
Compare
addaleax
approved these changes
Jun 30, 2026
| } while (processed > 0 && !data->empty() && tcp_); | ||
| } | ||
|
|
||
| void Write(const std::vector<char> data) override { |
Member
There was a problem hiding this comment.
random drive-by, feel free to take it or leave it, but I imagine this was just a typo:
Suggested change
| void Write(const std::vector<char> data) override { | |
| void Write(const std::vector<char>& data) override { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix a null pointer dereference crash in the inspector socket when writing to a connection that has already received EOF or encountered a protocol error.
Root Cause
There are two crash paths, both caused by
tcp_being null when dereferenced:Path 1: Async write after EOF
uv_read_cbfires →WsHandler::OnEof()→tcp_.reset()(setstcp_tonullptr)uv_async_tcallback fires →RequestQueueData::DoDispatch()→InspectorSocket::Write()→WsHandler::Write()→ProtocolHandler::WriteRaw()→ dereferences nulltcp_Path 2: Write triggered during OnData parsing
ParseWsFrames()encounters a compressed or error frame → callsOnEof()→tcp_.reset()delegate()->OnWsFrame()callback triggers a write back to the client →WsHandler::Write()→ProtocolHandler::WriteRaw()→ dereferences nulltcp_Both execute on the same libuv event loop thread (no multi-threading), so mutexes cannot help.
Crash signature (Windows x64)
0x148is the offset ofTcpHolder::handler_— confirmsthis == nullptr(i.e.,tcp_was null when dereferenced).Fix
WsHandler::OnData: stop the parsing loop whentcp_becomes null mid-iterationWsHandler::Write: early return whentcp_is null (avoids unnecessary frame encoding)ProtocolHandler::WriteRaw: defensive null guard covering all write pathsNo resource leak:
WriteRequestis only allocated insideTcpHolder::WriteRaw, which is never reached whentcp_is null. The-1return is consistent withuv_writefailure semantics.This is consistent with the existing pattern in
WsHandler::Shutdown()which already checksif (tcp_)before use.Fixes: #34833