You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
41 lines
1.5 KiB
41 lines
1.5 KiB
--- subversion-1.14.1/subversion/libsvn_repos/authz.c |
|
+++ subversion-1.14.1/subversion/libsvn_repos/authz.c |
|
@@ -130,6 +130,30 @@ |
|
static svn_object_pool__t *filtered_pool = NULL; |
|
static svn_atomic_t authz_pool_initialized = FALSE; |
|
|
|
+/* |
|
+ * Ensure that we will initialize authz again if the pool which |
|
+ * our authz caches depend on is cleared. |
|
+ * |
|
+ * HTTPD may run pre/post config hooks multiple times and clear |
|
+ * its global configuration pool which our authz pools depend on. |
|
+ * This happens in a non-threaded context during HTTPD's intialization |
|
+ * and HTTPD's main loop, so it is safe to reset static variables here. |
|
+ * (And any applications which cleared this pool while SVN threads |
|
+ * were running would crash no matter what.) |
|
+ * |
|
+ * See issue #4880, "Use-after-free of object-pools in |
|
+ * subversion/libsvn_repos/authz.c when used as httpd module" |
|
+ */ |
|
+static apr_status_t |
|
+deinit_authz(void *data) |
|
+{ |
|
+ /* The two object pools run their own cleanup handlers. */ |
|
+ authz_pool = NULL; |
|
+ filtered_pool = NULL; |
|
+ authz_pool_initialized = FALSE; |
|
+ return APR_SUCCESS; |
|
+} |
|
+ |
|
/* Implements svn_atomic__err_init_func_t. */ |
|
static svn_error_t * |
|
synchronized_authz_initialize(void *baton, apr_pool_t *pool) |
|
@@ -143,6 +167,7 @@ |
|
SVN_ERR(svn_object_pool__create(&authz_pool, multi_threaded, pool)); |
|
SVN_ERR(svn_object_pool__create(&filtered_pool, multi_threaded, pool)); |
|
|
|
+ apr_pool_cleanup_register(pool, NULL, deinit_authz, apr_pool_cleanup_null); |
|
return SVN_NO_ERROR; |
|
} |
|
|
|
|