Check io_event_handler state before using it

- kona: DF230106-00993
- asan: https://code.sec.samsung.net/jira/browse/TSEVEN-4216

Change-Id: I8917e67233f0f6d90f58e194151d6254089c72f9

diff --git a/packaging/capi-network-vine.spec b/packaging/capi-network-vine.spec
index 1fc44b02f7b9c42452ad2e4469f1c548bf8af833..11aaee70a638620a5abe694a267ae38db3bbe13c 100755 (executable)
--- a/packaging/capi-network-vine.spec
+++ b/packaging/capi-network-vine.spec
@@ -3,7 +3,7 @@
 %bcond_without use_glib_event_loop
 Name:    capi-network-vine
 Summary: An service discovery framework
-Version: 1.2.9
+Version: 1.3.0
 Release: 0
 Group:   Network & Connectivity/API
 License: Apache-2.0

diff --git a/src/vine-event-loop-epoll.cpp b/src/vine-event-loop-epoll.cpp
index 0747ee272ee3ffe03dcc680442e612b27b3d4f36..5ab153db2f8f55f16a7c0629d9971741a2365922 100755 (executable)
--- a/src/vine-event-loop-epoll.cpp
+++ b/src/vine-event-loop-epoll.cpp
@@ -58,6 +58,8 @@ typedef struct {
 
 static vine_epoll_io_event_handler *io_event_handlers[MAX_IO_EVENT_HANDLERS] = {0, };
 
+static vine_epoll_io_event_handler *_find_io_event_handler(int fd);
+
 static void *__vine_event_loop_epoll_run(void *arg)
 {
        VINE_LOGD("Run Vine event loop");
@@ -79,6 +81,11 @@ static void *__vine_event_loop_epoll_run(void *arg)
                }
 
                for (int i = 0; i < n; ++i) {
+                       if (_find_io_event_handler(events[i].data.fd) == NULL) {
+                               VINE_LOGI("Removed fd[%d]", events[i].data.fd);
+                               continue;
+                       }
+
                        vine_epoll_io_event_handler *h = (vine_epoll_io_event_handler *)events[i].data.ptr;
                        if (h && h->fd > 0 && h->handler)
                                h->handler(h->fd, events[i].events, h->user_data);
@@ -212,6 +219,8 @@ static void _del_io_event_handler(int fd)
 
 static vine_epoll_io_event_handler *_find_io_event_handler(int fd)
 {
+       if (fd < 0 || fd >= MAX_IO_EVENT_HANDLERS)
+               return NULL;
        return io_event_handlers[fd];
 }