You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by kg...@apache.org on 2021/01/20 20:07:47 UTC
[qpid-dispatch] branch master updated: DISPATCH-1916: fixes for
coverity use-after-free errors
This is an automated email from the ASF dual-hosted git repository.
kgiusti pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-dispatch.git
The following commit(s) were added to refs/heads/master by this push:
new 4b2fe64 DISPATCH-1916: fixes for coverity use-after-free errors
4b2fe64 is described below
commit 4b2fe64e37fdca5c4e07ed1d0f721b4ee083b794
Author: Kenneth Giusti <kg...@apache.org>
AuthorDate: Tue Jan 19 14:10:28 2021 -0500
DISPATCH-1916: fixes for coverity use-after-free errors
---
src/router_core/delivery.c | 17 ++++++++++-------
src/router_core/forwarder.c | 3 +++
2 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/src/router_core/delivery.c b/src/router_core/delivery.c
index 74d129a..411f3ba 100644
--- a/src/router_core/delivery.c
+++ b/src/router_core/delivery.c
@@ -838,18 +838,19 @@ void qdr_delivery_mcast_inbound_update_CT(qdr_core_t *core, qdr_delivery_t *in_d
qdr_delivery_push_CT(core, out_peer);
}
+ qd_log(core->log, QD_LOG_TRACE,
+ DLV_FMT" Updating mcast delivery out peer "DLV_FMT" updated disp=%s settled=%s",
+ DLV_ARGS(in_dlv), DLV_ARGS(out_peer), (push) ? "True" : "False", (unlink) ? "True" : "False");
+
if (moved) {
- // expect: in_dlv still references out_peer (with refcount), so
- // out_peer will not be freed by this decref:
- assert(!unlink || sys_atomic_get(&out_peer->ref_count) > 1);
+ // expect: in_dlv still references out_peer (with refcount), and
+ // there remains an old refcount from being on the unsettled list,
+ // so out_peer will not be freed by this decref:
+ assert(sys_atomic_get(&out_peer->ref_count) > 1);
qdr_delivery_decref_CT(core, out_peer,
"qdr_delivery_mcast_inbound_update_CT - removed out_peer from unsettled");
}
- qd_log(core->log, QD_LOG_TRACE,
- DLV_FMT" Updating mcast delivery out peer "DLV_FMT" updated disp=%s settled=%s",
- DLV_ARGS(in_dlv), DLV_ARGS(out_peer), (push) ? "True" : "False", (unlink) ? "True" : "False");
-
if (unlink) {
// expect: in_dlv should not be freed here as caller must hold reference:
assert(sys_atomic_get(&in_dlv->ref_count) > 1);
@@ -919,6 +920,8 @@ static bool qdr_delivery_mcast_outbound_settled_CT(qdr_core_t *core, qdr_deliver
out_dlv->settled = true;
if (qdr_delivery_settled_CT(core, out_dlv)) {
+ // expect: out_dlv reference count should include the unsettled list and the peer
+ assert(sys_atomic_get(&out_dlv->ref_count) > 1);
qdr_delivery_decref_CT(core, out_dlv, "qdr_delivery_mcast_outbound_settled_CT - out_dlv removed from unsettled");
}
diff --git a/src/router_core/forwarder.c b/src/router_core/forwarder.c
index be704ea..ff7e5f3 100644
--- a/src/router_core/forwarder.c
+++ b/src/router_core/forwarder.c
@@ -321,6 +321,9 @@ static void qdr_settle_subscription_delivery_CT(qdr_core_t *core, qdr_action_t *
bool moved = qdr_delivery_settled_CT(core, in_delivery);
if (moved) {
+ // expect: in_delivery has at least 2 refcounts - one from being on
+ // the unsettled list and another from the action
+ assert(sys_atomic_get(&in_delivery->ref_count) > 1);
qdr_delivery_decref_CT(core, in_delivery, "qdr_settle_subscription_delivery_CT - removed from unsettled");
qdr_delivery_push_CT(core, in_delivery);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org