Closed LarryOsterman closed 7 months ago
One other note: This only reduces the window associated with the bug - there is other code which checks the message_count
field and decides to reallocate/free the array based on that field value, this also can be subject to race conditions.
Fixes a race condition in
remove_pending_message_by_index
.The existing code in remove_pending_message_by_index had:
The problem is that if there was a context switch between the call to
free()
and before themessage_sender->messages
was set to NULL, then the call to reallocate the messages array in line 917:would reference freed memory and (if you were lucky) AV. If you weren't lucky, it corrupted memory.