Skip to content

forwarder: handle OOM/null paths in stream and connection callbacks#5826

Closed
YuF-9468 wants to merge 1 commit intomicrosoft:mainfrom
YuF-9468:fix-quicforward-allocation-guards
Closed

forwarder: handle OOM/null paths in stream and connection callbacks#5826
YuF-9468 wants to merge 1 commit intomicrosoft:mainfrom
YuF-9468:fix-quicforward-allocation-guards

Conversation

@YuF-9468
Copy link
Copy Markdown

Summary

  • add missing null checks for ForwardedSend allocations in StreamCallback
  • free SendContext before asserting on unexpected StreamSend failures to avoid leak-on-assert path
  • guard MsQuicStream and MsQuicConnection allocations in forwarder callbacks
  • close/release stream/connection resources on OOM paths

Fixes #5806

Testing

  • Not run in this environment (toolchain/build deps unavailable).
  • Change is limited to low-risk OOM/error-path guards in src/tools/forwarder/forwarder.cpp.

@YuF-9468 YuF-9468 requested a review from a team as a code owner February 28, 2026 16:37
@YuF-9468
Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree

Copy link
Copy Markdown
Collaborator

@guhetier guhetier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR largely duplicates #5807 and comes with similar issues at its first iterations. Lets keep the effort on one PR.

}
CXPLAT_FRE_ASSERT(QUIC_SUCCEEDED(Status));
if (QUIC_FAILED(Status)) {
ForwardedSend::Delete(SendContext);
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no point to handle cleanup if we assert success. FRE asserts are always active and fail-fast, resources will be returned to the OS anyway.

auto LocalStream = new(std::nothrow) MsQuicStream(Event->PEER_STREAM_STARTED.Stream, CleanUpAutoDelete, StreamCallback, PeerStream);
if (!LocalStream) {
delete PeerStream;
MsQuic->StreamClose(Event->PEER_STREAM_STARTED.Stream);
Copy link
Copy Markdown
Collaborator

@guhetier guhetier Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant with #5807 and has the same double-free issue as the first iteration of this PR.

@YuF-9468
Copy link
Copy Markdown
Author

YuF-9468 commented Mar 3, 2026

Thanks for the review — agreed. This PR overlaps with #5807, so I'll close this one and keep the effort focused there to avoid duplicate review load.

@YuF-9468 YuF-9468 closed this Mar 3, 2026
@YuF-9468 YuF-9468 deleted the fix-quicforward-allocation-guards branch March 3, 2026 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Null pointer dereference on allocation failure in quicforward

2 participants