From ac304e80fdb001bca139723f77dff21db2b587aa Mon Sep 17 00:00:00 2001 From: Alan Conway Date: Thu, 18 Aug 2011 18:03:22 +0000 Subject: QPID-3033: Segmentation fault while processing session.attach The initial fix for this bug was incomplete. The original bug was triggered by a faulty client sending session.attach before connection.open. The special case is when the session.attach is on channel 0. This commit fixes the broker for all cases where a faulty client sends frames before completly opening the connection. Older versions of the Java client are known to send this faulty sequence sporadically, see https://issues.apache.org/jira/browse/QPID-3042. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@1159329 13f79535-47bb-0310-9956-ffa450edef68 --- cpp/src/qpid/broker/Connection.cpp | 11 +---------- cpp/src/qpid/broker/ConnectionHandler.cpp | 9 ++++++++- 2 files changed, 9 insertions(+), 11 deletions(-) (limited to 'cpp/src') diff --git a/cpp/src/qpid/broker/Connection.cpp b/cpp/src/qpid/broker/Connection.cpp index 8362a9782c..0b3059d26c 100644 --- a/cpp/src/qpid/broker/Connection.cpp +++ b/cpp/src/qpid/broker/Connection.cpp @@ -156,16 +156,7 @@ Connection::~Connection() void Connection::received(framing::AMQFrame& frame) { // Received frame on connection so delay timeout restartTimeout(); - - if (frame.getChannel() == 0 && frame.getMethod()) { - adapter.handle(frame); - } else { - if (adapter.isOpen()) - getChannel(frame.getChannel()).in(frame); - else - close(connection::CLOSE_CODE_FRAMING_ERROR, "Connection not yet open, invalid frame received."); - } - + adapter.handle(frame); if (isLink) //i.e. we are acting as the client to another broker recordFromServer(frame); else diff --git a/cpp/src/qpid/broker/ConnectionHandler.cpp b/cpp/src/qpid/broker/ConnectionHandler.cpp index 270711705e..948aa04417 100644 --- a/cpp/src/qpid/broker/ConnectionHandler.cpp +++ b/cpp/src/qpid/broker/ConnectionHandler.cpp @@ -68,8 +68,15 @@ void ConnectionHandler::handle(framing::AMQFrame& frame) AMQMethodBody* method=frame.getBody()->getMethod(); Connection::ErrorListener* errorListener = handler->connection.getErrorListener(); try{ - if (!invoke(static_cast(*handler.get()), *method)) { + if (method && invoke( + static_cast(*handler), *method)) { + // This is a connection control frame, nothing more to do. + } else if (isOpen()) { handler->connection.getChannel(frame.getChannel()).in(frame); + } else { + handler->proxy.close( + connection::CLOSE_CODE_FRAMING_ERROR, + "Connection not yet open, invalid frame received."); } }catch(ConnectionException& e){ if (errorListener) errorListener->connectionError(e.what()); -- cgit v1.2.1