Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use-after-free bug #1

Closed
maryryang opened this issue May 20, 2019 · 2 comments
Closed

Use-after-free bug #1

maryryang opened this issue May 20, 2019 · 2 comments

Comments

@maryryang
Copy link
Contributor

The following code flow produces a use-after-free bug:

  1. We call zoo_awexists here: https://github.com/flightaware/zookeepertcl/blob/master/generic/zookeepertcl.c#L1270
  2. The full initialization fails here: https://github.com/apache/zookeeper/blob/master/zookeeper-client/zookeeper-client-c/src/zookeeper.c#L3796. This means that we did still register the callback here: https://github.com/apache/zookeeper/blob/master/zookeeper-client/zookeeper-client-c/src/zookeeper.c#L3793. And we will still queue the zookeeper request here: https://github.com/apache/zookeeper/blob/master/zookeeper-client/zookeeper-client-c/src/zookeeper.c#L3806. AND zoo_awexists will return a ZMARSHALLINGERROR.
  3. Since we return the ZMARSHALLINGERROR, we call free here: https://github.com/flightaware/zookeepertcl/blob/master/generic/zookeepertcl.c#L1273, but we are STILL going to receive a callback from zookeeper.
  4. When we receive the callback (https://github.com/flightaware/zookeepertcl/blob/master/generic/zookeepertcl.c#L489), we are using the same zsc pointer that we have already freed.
@resuna
Copy link
Member

resuna commented Jul 8, 2019

Still getting a use-after-free problem with this change. Going to change the semantics of the synchronous calls to use the synchronous zookeeper API to resolve this and some other bugs, if you need to keep the event loop running while you're doing a pseudo-synchronous zookeeper operation you will have to explicitly do things with the -async callback option and vwait.

This will be either v1.1.0 or v2.0.0.

@resuna
Copy link
Member

resuna commented Jul 15, 2019

Fixed in v1.1.0

@resuna resuna closed this as completed Jul 15, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants