You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Because aeron_client_conductor_check_lingering_resources never updates last_index, if it frees more than one log_buffer, we end up with duplicates in lingering_resources.
Say we start with lingering_resources = [A, B, C, D] and we are going to delete A and B.
As the loop deletes A and B, aeron_array_fast_unordered_remove copies from last_index (D) into the slots previously occupied by A and B.
So we end up with lingering_resources = [D, D]
Next time aeron_client_conductor_check_lingering_resources is called, we can double-free and crash.
I wonder if the same bug is present in other functions, but aeron_client_conductor_check_lingering_resources is the only one I can reliably break.
If you have a proposed fix for this problem it should be easy for me to test it, just let me know.
Thanks!
The text was updated successfully, but these errors were encountered:
Because aeron_client_conductor_check_lingering_resources never updates last_index, if it frees more than one log_buffer, we end up with duplicates in lingering_resources.
Say we start with lingering_resources = [A, B, C, D] and we are going to delete A and B.
As the loop deletes A and B, aeron_array_fast_unordered_remove copies from last_index (D) into the slots previously occupied by A and B.
So we end up with lingering_resources = [D, D]
Next time aeron_client_conductor_check_lingering_resources is called, we can double-free and crash.
I wonder if the same bug is present in other functions, but aeron_client_conductor_check_lingering_resources is the only one I can reliably break.
If you have a proposed fix for this problem it should be easy for me to test it, just let me know.
Thanks!
The text was updated successfully, but these errors were encountered: