Skip to content

fix: Use-After-Free in Connection::close() - #936

Closed
jprzimba wants to merge 2 commits into
mainfrom
connection
Closed

jprzimba wants to merge 2 commits into
mainfrom
connection

Conversation

@jprzimba

@jprzimba jprzimba commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

This change moves the ConnectionManager release call out of the critical section in Connection::close(). The connection lock is now cleared before releasing the connection back to the manager, avoiding lock-ordering and re-entrancy issues while the socket is being torn down.

Fix protocol send callback race
Capture the active protocol before calling onSendMessage while the worker lock is released. This prevents dereferencing a stale or replaced protocol pointer during message sending and avoids potential use-after-free issues.

This change moves the ConnectionManager release call out of the critical section in Connection::close(). The connection lock is now cleared before releasing the connection back to the manager, avoiding lock-ordering and re-entrancy issues while the socket is being torn down.
Capture the active protocol before calling onSendMessage while the worker lock is released. This prevents dereferencing a stale or replaced protocol pointer during message sending and avoids potential use-after-free issues.
@jprzimba jprzimba closed this Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant