From fafe647bc2e2d11670bb79a1dc91cfd5632e2eb1 Mon Sep 17 00:00:00 2001 From: eldritch horrors Date: Fri, 10 Jan 2025 17:05:02 +0100 Subject: [PATCH] libstore: fix UAF in FileTransfer after startTransfer the transfer, and thus downloadState, is gone. asan hasn't caught this, presumably because the access is in libc somewhere. we don't even need access to the old state; the assertion is not useful here and clearing the previous exception is invisible to the new round. Change-Id: I32dc1a487b96cbaabcf5061c9b1f96dbc5aaae49 --- lix/libstore/filetransfer.cc | 6 ------ 1 file changed, 6 deletions(-) diff --git a/lix/libstore/filetransfer.cc b/lix/libstore/filetransfer.cc index 511244479..967e40954 100644 --- a/lix/libstore/filetransfer.cc +++ b/lix/libstore/filetransfer.cc @@ -845,10 +845,6 @@ struct curlFileTransfer : public FileTransfer bool attemptRetry(const std::string & context) { - auto state(transfer->downloadState.lock()); - - assert(state->data.empty()); - thread_local std::minstd_rand random{std::random_device{}()}; std::uniform_real_distribution<> dist(0.0, 0.5); int ms = parent.baseRetryTimeMs * std::pow(2.0f, attempt - 1 + dist(random)); @@ -860,8 +856,6 @@ struct curlFileTransfer : public FileTransfer std::this_thread::sleep_for(std::chrono::milliseconds(ms)); - state->exc = nullptr; - // use the effective URI of the previous transfer for retries. this avoids // some silent corruption if a redirect changes between starting and retry const auto & uri = metadata.effectiveUri.empty() ? this->uri : metadata.effectiveUri;