From be3766e32550798ea5fe60cb2a13d703ff818636 Mon Sep 17 00:00:00 2001 From: kgershov Date: Fri, 19 Jun 2026 16:53:22 +0300 Subject: [monlib] Fix use-after-free in TMonService2 destructor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TMonService2 binds `this` into the HTTP handler stored in TMtHttpServer. Stop() was only called from TImpl::~TImpl() — after TMonService2 members (IndexMonPage, AuthProvider_) had already been destroyed. A concurrent request could call ServeRequest() and crash on IndexMonPage->Output(). Fix: call Stop() in ~TMonService2() before member destruction. commit_hash:f5b6aff5d9f85ae76d121a036bfd30094377c5ca --- library/cpp/monlib/service/monservice.h | 1 + 1 file changed, 1 insertion(+) (limited to 'library/cpp') diff --git a/library/cpp/monlib/service/monservice.h b/library/cpp/monlib/service/monservice.h index 3116a767654..299b9a48a4f 100644 --- a/library/cpp/monlib/service/monservice.h +++ b/library/cpp/monlib/service/monservice.h @@ -45,6 +45,7 @@ namespace NMonitoring { explicit TMonService2(const THttpServerOptions& options, TSimpleSharedPtr pool, const TString& title = GetProgramName(), THolder auth = nullptr); ~TMonService2() override { + Stop(); } const char* GetStartTime() const { -- cgit v1.3