Skip to content
This repository has been archived by the owner on Jun 23, 2022. It is now read-only.

fix(asan): heap-use-after-free in simple_lb_cure_test.cpp #375

Merged
merged 2 commits into from
Jan 10, 2020

Conversation

foreverneverer
Copy link
Contributor

@foreverneverer foreverneverer commented Jan 8, 2020

Related issue: #364

The reason is svc->set_filter(default_filter) free the heap which is located by svc->set_filter([&](const dsn::rpc_address &target, dsn::message_ex *req) -> cur_ptr {...});, and the variable proposal_sent is also freed, however, it is still used in L435.

Related code:

svc->set_filter([&](const dsn::rpc_address &target, dsn::message_ex *req) -> cur_ptr {
dsn::message_ex *recv_request = create_corresponding_receive(req);
cur_ptr update_req = std::make_shared<configuration_update_request>();
::dsn::unmarshall(recv_request, *update_req);
destroy_message(recv_request);
EXPECT_EQ(update_req->type, config_type::CT_ADD_SECONDARY);
EXPECT_FALSE(is_secondary(pc, update_req->node));
EXPECT_EQ(target, pc.primary);
svc->set_node_state({pc.primary}, false);
svc->set_filter(default_filter);
proposal_sent = true;
return nullptr;
});

Solution

proposal_sent=true before svc->set_filter(default_filter)

@vagetablechicken
Copy link
Member

这个和simple_lb_cure_test出现过得几次core可能有关系?

@foreverneverer
Copy link
Contributor Author

这个和simple_lb_cure_test出现过得几次core可能有关系?

core的日志还有吗?

@vagetablechicken
Copy link
Member

这个和simple_lb_cure_test出现过得几次core可能有关系?

core的日志还有吗?

#333

@foreverneverer
Copy link
Contributor Author

这个和simple_lb_cure_test出现过得几次core可能有关系?

core的日志还有吗?

#333

core的地方的确是有hedap-use-after-free的问题,是不是这个引起的还不确定。

@vagetablechicken
Copy link
Member

这个和simple_lb_cure_test出现过得几次core可能有关系?

core的日志还有吗?

#333

core的地方的确是有hedap-use-after-free的问题,是不是这个引起的还不确定。

三个core的情况, 解决了哪一个?

@foreverneverer
Copy link
Contributor Author

这个和simple_lb_cure_test出现过得几次core可能有关系?

core的日志还有吗?

#333

core的地方的确是有hedap-use-after-free的问题,是不是这个引起的还不确定。

三个core的情况, 解决了哪一个?

我看三个core都是测试Case: recover from DDD state, only one primary出现的,解决与否不知道啊~

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
1.12.3 type/sanitize Fixes on errors reported by sanitizers.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants