search

Azure / azure-uamqp-c

AMQP library for C
Other
58 stars 62 forks source link

Fixed race condition in sendAsync related to messages; fixed local_server_sample to no longer AV. #430

Closed LarryOsterman closed 7 months ago

LarryOsterman commented 1 year ago

Fixes a race condition in remove_pending_message_by_index.

The existing code in remove_pending_message_by_index had:

        free(message_sender->messages);
        message_sender->messages = NULL;

The problem is that if there was a context switch between the call to free() and before the message_sender->messages was set to NULL, then the call to reallocate the messages array in line 917:

               ASYNC_OPERATION_HANDLE* new_messages = (ASYNC_OPERATION_HANDLE*)realloc(message_sender->messages, sizeof(ASYNC_OPERATION_HANDLE) * (message_sender->message_count + 1));

would reference freed memory and (if you were lucky) AV. If you weren't lucky, it corrupted memory.

LarryOsterman commented 1 year ago

One other note: This only reduces the window associated with the bug - there is other code which checks the message_count field and decides to reallocate/free the array based on that field value, this also can be subject to race conditions.