Race condition in client array management

[mgrossmann]

Summary

New HTTP clients are added to the shared client array without holding a lock. Worker threads iterating the array could access a partially initialized HTTPC structure.

Affected Files

• src/httpd.c:670-704

Details

httpc = calloc(1, sizeof(HTTPC));
/* ... initialize fields ... */
array_add(&httpd->httpc, httpc);  /* no lock */

Fix

Wrap array_add() in lock(httpd, 0) / unlock(httpd, 0).

Severity

HIGH — potential crash or data corruption under concurrent load.