socksproxy: Fix localhost DNS and use-after-free crash #10332
Merged
+109
−72
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
In continuing my testing with the socksproxy and the DNS resolution woes, I came across a couple of bugs that can lead to breakage.
The first issue is that when selecting DNS servers, when the first choice is a link-local IPv6 address, we don't set a scope ID in the address, which can prevent
c-ares
from being able to connect to it. We can fix this just by callingQHostAddress::setScopeId()
when building the list of DNS servers. While implementing this, I also performed a bit of cleanup by moving the DNS server selection intoWindowsBypass::updateNamserver()
The second issue, which was a bit trickier to track down, is that we have a use-after-free bug in the socks proxy that can occur between the
c-ares
resolver thread and the Qt thread. This happens when theSocks5Connection
is closed before DNS resolution finishes, in which case thearg
provided to the c-ares callback points to freed memory. To resolve this, we need to verify that theQObject
is valid before invoking theonResolutionFinished()
method. We add aQHash
map to store the objects that requested resolution, and use theQObject::destroyed()
signal to track when they are garabge collected.Reference
Based upon PR #10317 by @strseb
JIRA Issues:
Checklist