curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)
该报告还没有中文解读。
原文摘录
摘自原文（12488 字符中的一小部分）
curl's non-blocking connection shutdown machinery (`lib/cshutdn.c`) is supposed to enforce a 2-second shutdown timeout (`DEFAULT_SHUTDOWN_TIMEOUT_MS`) on connections whose peer never answers the graceful shutdown. In `curl_multi_socket_action()` event-driven mode the machinery deadlocks: the only …
原文中的代码
// lib/cshutdn.c (Curl_cshutdn_start_timer)
conn->shutdown.start_ms[sockindex] = curlx_ptimediff_ms(pnow, &conn->created);
conn->shutdown.timeout_ms = ... : DEFAULT_SHUTDOWN_TIMEOUT_MS; /* 2000 */
/* Set a timer, unless we operate on the admin handle */
if(data->mid)
Curl_expire_set(data, …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @noraqiu · 版权归作者与 curl 所有