控制外部指针在future中的传递层数。

修复future-promise 回调函数中的use after free，包括web cache pend, web cache write和key keeper。
修复decrypt mirror中的写越界。

5 files changed, 11 insertions, 13 deletions

diff --git a/platform/src/key_keeper.cpp b/platform/src/key_keeper.cpp
index 3fe6f02..c466092 100644
--- a/platform/src/key_keeper.cpp
+++ b/platform/src/key_keeper.cpp
@@ -354,17 +354,15 @@ static void certstore_rpc_on_succ(void* result, void* user)
 			{
 				key_keeper_free_keyring((struct keyring*)kyr);
 			}
-		}
+		}		
+		ctx->ref_keeper->stat.new_issue++;
 		promise_success(p, (void*)kyr);
 		key_keeper_free_keyring((struct keyring*)kyr);
-		ctx->ref_keeper->stat.new_issue++;
 	}
 	else
 	{
 		promise_failed(p, FUTURE_ERROR_EXCEPTION, status_msg);
 	}
-	//promise_dettach_ctx(p);
-	//ctx_destroy_cb((void*)ctx);
 }
 
 static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user)
diff --git a/plugin/business/decrypt-mirroring/src/mirror_stream.cpp b/plugin/business/decrypt-mirroring/src/mirror_stream.cpp
index ba89855..6aaf20c 100644
--- a/plugin/business/decrypt-mirroring/src/mirror_stream.cpp
+++ b/plugin/business/decrypt-mirroring/src/mirror_stream.cpp
@@ -712,7 +712,7 @@ int deliver_init_log()
 	int i=0;
 	int j=0;
 	
-	char mac_str[DELIVER_MACADDR_STR_LEN]={0};
+	char mac_str[DELIVER_MACADDR_STR_LEN+1]={0};
 	
 	for(j = 0; j < 6; j++)
 	{
diff --git a/plugin/business/pangu-http/src/pangu_http.cpp b/plugin/business/pangu-http/src/pangu_http.cpp
index 33b44eb..4fb4eba 100644
--- a/plugin/business/pangu-http/src/pangu_http.cpp
+++ b/plugin/business/pangu-http/src/pangu_http.cpp
@@ -1292,7 +1292,7 @@ static void cache_pend_on_succ(future_result_t * result, void * user)
 {
 	struct pangu_http_ctx * ctx = (struct pangu_http_ctx *)user;
 	const struct cached_meta* meta=NULL;
-	meta=cache_pending_result_read_meta(result);
+	meta=cache_pending_result_read_meta(result, ctx->cmid);
 	ctx->resumed_cb=dummy_resume;
 	tfe_http_session_resume(ctx->ref_session);	
 	ATOMIC_DEC(&(g_pangu_rt->stat_val[STAT_SUSPENDING]));
diff --git a/plugin/business/pangu-http/src/pangu_web_cache.cpp b/plugin/business/pangu-http/src/pangu_web_cache.cpp
index 7e62313..3ec55bd 100644
--- a/plugin/business/pangu-http/src/pangu_web_cache.cpp
+++ b/plugin/business/pangu-http/src/pangu_web_cache.cpp
@@ -954,7 +954,7 @@ struct cache_pending_context
 
 	char* url;
 	struct cached_meta cached_obj_meta;
-	struct cache_mid* ref_mid;
+	enum OBJECT_LOCATION location;
 	struct cache_handle* ref_handle;
 	struct tango_cache_result* ref_tango_cache_result;
 	struct future* f_tango_cache_fetch;
@@ -976,9 +976,10 @@ void cache_pending_ctx_free_cb(void* p)
 	free(ctx);
 	return;
 }
-const struct cached_meta* cache_pending_result_read_meta(future_result_t * result)
+const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid)
 {
 	struct cache_pending_context* ctx=(struct cache_pending_context*)result;
+	mid->location=ctx->location;
 	if(ctx->status==PENDING_RESULT_MISS)
 	{
 		return NULL;
@@ -1015,8 +1016,8 @@ static void cache_read_meta_on_succ(future_result_t * result, void * user)
 			TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache meta read miss: %s", ctx->url);
 			//NOT break intentionally.
 		case RESULT_TYPE_END:
-			//last call.	
-			ctx->ref_mid->location=_result->location;
+			//last call.
+			ctx->location=_result->location;
 			ATOMIC_DEC(&(ctx->ref_handle->stat_val[STAT_CACHE_PENDING]));	
 			promise_dettach_ctx(p);		
 			promise_success(p, ctx);
@@ -1162,7 +1163,6 @@ enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, u
 	ctx->status=PENDING_RESULT_FOBIDDEN;	
 	ctx->ref_handle=handle;
 	ctx->url=tfe_strdup(request->req_spec.url);
-	ctx->ref_mid=_mid;
 	ctx->req_if_modified_since=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_MODIFIED_SINCE));
 	ctx->req_if_none_match=tfe_strdup(tfe_http_std_field_read(request, TFE_HTTP_IF_NONE_MATCH));
 	promise_set_ctx(p, ctx, cache_pending_ctx_free_cb);
@@ -1243,8 +1243,8 @@ static void wrap_cache_write_on_fail(enum e_future_error err, const char * what,
 {
 	struct cache_write_future_ctx* ctx=(struct cache_write_future_ctx*)user;
 	TFE_LOG_DEBUG(ctx->ref_handle->logger, "cache upload failed: %s %s lapse: %d", ctx->url, what, time(NULL)-ctx->start);
-	cache_write_future_ctx_free(ctx);
 	ATOMIC_INC(&(ctx->ref_handle->stat_val[STAT_CACHE_WRITE_ERR]));
+	cache_write_future_ctx_free(ctx);
 }
 
 struct cache_write_context* web_cache_write_start(struct cache_handle* handle, unsigned int thread_id, 
diff --git a/plugin/business/pangu-http/src/pangu_web_cache.h b/plugin/business/pangu-http/src/pangu_web_cache.h
index ce381ba..1f384a3 100644
--- a/plugin/business/pangu-http/src/pangu_web_cache.h
+++ b/plugin/business/pangu-http/src/pangu_web_cache.h
@@ -48,7 +48,7 @@ const char* cache_pending_result_string(enum cache_pending_result);
 struct cache_mid;
 void cache_mid_clear(struct cache_mid **mid);
 
-const struct cached_meta* cache_pending_result_read_meta(future_result_t * result);
+const struct cached_meta* cache_pending_result_read_meta(future_result_t * result, struct cache_mid* mid);
 enum cache_pending_result web_cache_async_pending(struct cache_handle* handle, unsigned int thread_id,
 							const struct tfe_http_half * request, struct cache_mid **mid, struct future* f_revalidate);