[
https://issues.apache.org/jira/browse/PROTON-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123599#comment-18123599
]
ASF subversion and git services commented on PROTON-2938:
---------------------------------------------------------
Commit 73f4fb090cc76fdcc3eb33545f030ca8fc326a7e in qpid-proton's branch
refs/heads/main from Andrew Stitcher
[ https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=73f4fb090 ]
PROTON-2938: Fix use after free when error happens in Win IOCP proactor
The rarely used pn_error_copy tried to strdup a string it had just
freed if it was copying from and to the same error.
> WIN: Heap Corruption Exiting Application
> -----------------------------------------
>
> Key: PROTON-2938
> URL: https://issues.apache.org/jira/browse/PROTON-2938
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Affects Versions: proton-c-0.41.0
> Reporter: Jaime Heilpern
> Priority: Major
>
> Steps to Reproduce:
> ~ Python Proton server, mTLS
> ~ C++ application (using gflags) connected to the Python Proton server
> successfully, messages work etc.
> ~ ctrl-c on the C++ app.exe and the heap corruption with that stack above
> shows
> {code:java}
> ucrtbased.dll!00007ffb465b1691() Unknown >
> qpid-proton-cored.dll!pn_strdup(const char * src) Line 122 C
> qpid-proton-cored.dll!pn_error_set(pn_error_t * error, int code, const char *
> text) Line 77 C qpid-proton-cored.dll!pn_error_copy(pn_error_t * error,
> pn_error_t * src) Line 119 C
> qpid-proton-proactord.dll!pn_experimental::pni_iocp_recv(pn_experimental::iocpdesc_t
> * iocpd, void * buf, unsigned __int64 size, bool * would_block, pn_error_t *
> error) Line 1126 C++
> qpid-proton-proactord.dll!pconnection_process(pconnection_t * pc,
> pn_experimental::iocp_result_t * result, bool topup) Line 2380 C++
> qpid-proton-proactord.dll!psocket_process(psocket_t * ps,
> pn_experimental::iocp_result_t * result, reaper * rpr) Line 2500 C++
> qpid-proton-proactord.dll!proactor_completion_loop(pn_proactor_t * p, bool
> can_block) Line 2541 C++
> qpid-proton-proactord.dll!pn_proactor_wait(pn_proactor_t * p) Line 2566 C++
> qpid-proton-cppd.dll!proton::container::impl::thread() Line 770 C++
> qpid-proton-cppd.dll!proton::container::impl::run(int threads) Line 821 C++
> qpid-proton-cppd.dll!proton::container::run() Line 92 C++ [downstream
> application frame] - dest 0x00000279dc2b0fa0 <Error reading characters of
> string.> char * <Unable to read memory> char - src 0x00000279dc2b0fa0 <Error
> reading characters of string.> const char * <Unable to read memory> const char
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
