Merge pull request #439 from mo-xiaoming/rpc-leak

hobbes::variant tag becomes invalid causes buffer overrun during destruction calls
morganstanley · Jul 6, 2022 · 02eae25 · 02eae25
2 parents fc1bf3b + a2c0d38
commit 02eae25
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/include/hobbes/net.H b/include/hobbes/net.H
@@ -807,10 +807,10 @@ template <typename ... Fs>
     }
     static bool accum(int s, async_read_state* o, tuple<Fs...>* x) {
       if (o->template apply<bool, tupAsyncAcc, tuple<Fs...>, int, tuple<Fs...>*>(s, x)) {
-        ++o->unsafeTag();
-        if (o->unsafeTag() == sizeof...(Fs)) {
+        if (o->unsafeTag() == sizeof...(Fs)-1) {
           return true;
         } else {
+          ++o->unsafeTag();
           variantApp<void, tupAsyncInit, void, tuple<Fs...>, void*>::apply(o->unsafeTag(), o->unsafePayload(), o->unsafePayload());
           return false;
         }
@@ -1013,6 +1013,7 @@ template <typename R, typename ... Args>
         this->ks.front()(this->r);
         this->ks.pop();
         this->r = R();
+        this->pr = async_read_state();
         io<R>::prepare(&this->pr);
         return true;
       } else {