Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aeron_client_conductor_check_lingering_resources can corrupt conductor->lingering_resources #1728

Closed
lukeocamden opened this issue Jan 23, 2025 · 0 comments

Comments

@lukeocamden
Copy link

Because aeron_client_conductor_check_lingering_resources never updates last_index, if it frees more than one log_buffer, we end up with duplicates in lingering_resources.

Say we start with lingering_resources = [A, B, C, D] and we are going to delete A and B.

As the loop deletes A and B, aeron_array_fast_unordered_remove copies from last_index (D) into the slots previously occupied by A and B.

So we end up with lingering_resources = [D, D]

Next time aeron_client_conductor_check_lingering_resources is called, we can double-free and crash.

I wonder if the same bug is present in other functions, but aeron_client_conductor_check_lingering_resources is the only one I can reliably break.

If you have a proposed fix for this problem it should be easy for me to test it, just let me know.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant