Fix NPE race in NettyResponseFuture.cancel (AsyncHttpClient#2042)

prat · prat · commit 4bd4f10273cf · 2025-05-08T00:57:49.000+05:30
diff --git a/client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java b/client/src/main/java/org/asynchttpclient/netty/NettyResponseFuture.java
@@ -187,10 +187,10 @@ public boolean cancel(boolean force) {
             return false;
         }
 
-        // cancel could happen before channel was attached
-        if (channel != null) {
-            Channels.setDiscard(channel);
-            Channels.silentlyCloseChannel(channel);
+        Channel ch = channel; //atomic read, so that it won't end up in TOCTOU
+        if (ch != null) {
+            Channels.setDiscard(ch);
+            Channels.silentlyCloseChannel(ch);
         }
 
         if (ON_THROWABLE_CALLED_FIELD.getAndSet(this, 1) == 0) {

Original file line number	Diff line number	Diff line change
`@@ -187,10 +187,10 @@ public boolean cancel(boolean force) {`
`187`	`187`	`return false;`
`188`	`188`	`}`
`189`	`189`
`190`		`- // cancel could happen before channel was attached`
`191`		`- if (channel != null) {`
`192`		`- Channels.setDiscard(channel);`
`193`		`- Channels.silentlyCloseChannel(channel);`
	`190`	`+ Channel ch = channel; //atomic read, so that it won't end up in TOCTOU`
	`191`	`+ if (ch != null) {`
	`192`	`+ Channels.setDiscard(ch);`
	`193`	`+ Channels.silentlyCloseChannel(ch);`
`194`	`194`	`}`
`195`	`195`
`196`	`196`	`if (ON_THROWABLE_CALLED_FIELD.getAndSet(this, 1) == 0) {`