From: Nick Mathewson <nickm@torproject.org>
Date: Wed, 8 Apr 2009 03:05:42 +0000 (+0000)
Subject: Prevent unsupported modifications to bufferevent_sock buffers.
X-Git-Tag: release-2.0.1-alpha~45
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=72b6ffe869f63180a55f7c3d2582dc1c37314cc5;p=libevent

Prevent unsupported modifications to bufferevent_sock buffers.

In particular, we don't allow adding any data to end front of inbuf
(we do that when we read), or removing it from the front of outbuf (we
drain data only when we write).

svn:r1144
---

diff --git a/ChangeLog b/ChangeLog
index 01f0bb8b..e74c864e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -144,7 +144,7 @@ Changes in current version:
  o New evutil_make_listen_socket_reuseable() to abstract SO_REUSEADDR.
  o New bind-to option to allow DNS clients to bind to an arbitrary port for outgoing requests.
  o evbuffers can now be "frozen" to prevent operations at one or both ends.
-
+ o Bufferevents now notice external attempts to add data to an inbuf or remove it from an outbuf, and stop them.
 
 Changes in 1.4.0:
  o allow \r or \n individually to separate HTTP headers instead of the standard "\r\n"; from Charles Kerr.
diff --git a/bufferevent_sock.c b/bufferevent_sock.c
index 679204d0..391d99b1 100644
--- a/bufferevent_sock.c
+++ b/bufferevent_sock.c
@@ -134,7 +134,9 @@ bufferevent_readcb(evutil_socket_t fd, short event, void *arg)
 		}
 	}
 
+	evbuffer_unfreeze(input, 0);
 	res = evbuffer_read(input, fd, howmuch);
+	evbuffer_freeze(input, 0);
 
 	if (res == -1) {
 		int err = evutil_socket_geterror(fd);
@@ -180,7 +182,9 @@ bufferevent_writecb(evutil_socket_t fd, short event, void *arg)
 	}
 
 	if (EVBUFFER_LENGTH(bufev->output)) {
+	    evbuffer_unfreeze(bufev->output, 1);
 	    res = evbuffer_write(bufev->output, fd);
+	    evbuffer_freeze(bufev->output, 1);
 	    if (res == -1) {
 			int err = evutil_socket_geterror(fd);
 			if (EVUTIL_ERR_RW_RETRIABLE(err))
@@ -239,6 +243,9 @@ bufferevent_socket_new(struct event_base *base, evutil_socket_t fd,
 
 	evbuffer_add_cb(bufev->output, bufferevent_socket_outbuf_cb, bufev);
 
+	evbuffer_freeze(bufev->input, 0);
+	evbuffer_freeze(bufev->output, 1);
+
 	return bufev;
 }