corvvs / webserv

simple and light http-server like NGINX in C++
4 stars 2 forks source link

bugfix: アボートする, `Optional`? #232

Closed corvvs closed 2 years ago

corvvs commented 2 years ago

CGIスクリプトをいじってると落ちた。サニタイザがなかったので詳細不明。

corvvs commented 2 years ago
=================================================================
==3339==ERROR: AddressSanitizer: attempting double-free on 0x0001063549b0 in thread T0:
    #0 0x1045b9018 in wrap__ZdlPv+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4d018)
    #1 0x102e67bc8 in void std::__1::__libcpp_operator_delete<void*>(void*) new:245
    #2 0x102e67ba4 in void std::__1::__do_deallocate_handle_size<>(void*, unsigned long) new:269
    #3 0x102e67b7c in std::__1::__libcpp_deallocate(void*, unsigned long, unsigned long) new:279
    #4 0x102e80728 in std::__1::allocator<char>::deallocate(char*, unsigned long) memory:879
    #5 0x102e80474 in std::__1::allocator_traits<std::__1::allocator<char> >::deallocate(std::__1::allocator<char>&, char*, unsigned long) allocator_traits.h:280
    #6 0x102e7dc1c in std::__1::__vector_base<char, std::__1::allocator<char> >::~__vector_base() vector:466
    #7 0x103190e9c in std::__1::vector<char, std::__1::allocator<char> >::~vector() vector:557
    #8 0x1031842fc in std::__1::vector<char, std::__1::allocator<char> >::~vector() vector:552
    #9 0x10318dde8 in std::__1::allocator<std::__1::vector<char, std::__1::allocator<char> > >::destroy(std::__1::vector<char, std::__1::allocator<char> >*) memory:921
    #10 0x10318d728 in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::unset() http.hpp:208
    #11 0x10318f3c8 in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::~Optional() http.hpp:181
    #12 0x10318aabc in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::~Optional() http.hpp:180
    #13 0x10319063c in HTTP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:95
    #14 0x10329c9bc in CGIP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:249
    #15 0x1032940c4 in CGIP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:249
    #16 0x1032a1698 in CGI::RoutingParameters::~RoutingParameters() CGI.hpp:90
    #17 0x103276318 in CGI::RoutingParameters::~RoutingParameters() CGI.hpp:90
    #18 0x103276ebc in CGI::~CGI() CGI.cpp:90
    #19 0x1032771b0 in CGI::~CGI() CGI.cpp:77
    #20 0x10327722c in CGI::~CGI() CGI.cpp:77
    #21 0x103516830 in EventPollLoop::update() Eventpollloop.cpp:125
    #22 0x103513388 in EventPollLoop::loop() Eventpollloop.cpp:20
    #23 0x103034e70 in HTTPServer::run() HTTPServer.cpp:60
    #24 0x1035bbd20 in main main.cpp:34
    #25 0x1041b10f0 in start+0x204 (dyld:arm64e+0x50f0)

0x0001063549b0 is located 0 bytes inside of 10-byte region [0x0001063549b0,0x0001063549ba)
freed by thread T0 here:
    #0 0x1045b9018 in wrap__ZdlPv+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4d018)
    #1 0x102e67bc8 in void std::__1::__libcpp_operator_delete<void*>(void*) new:245
    #2 0x102e67ba4 in void std::__1::__do_deallocate_handle_size<>(void*, unsigned long) new:269
    #3 0x102e67b7c in std::__1::__libcpp_deallocate(void*, unsigned long, unsigned long) new:279
    #4 0x102e80728 in std::__1::allocator<char>::deallocate(char*, unsigned long) memory:879
    #5 0x102e80474 in std::__1::allocator_traits<std::__1::allocator<char> >::deallocate(std::__1::allocator<char>&, char*, unsigned long) allocator_traits.h:280
    #6 0x102e7dc1c in std::__1::__vector_base<char, std::__1::allocator<char> >::~__vector_base() vector:466
    #7 0x103190e9c in std::__1::vector<char, std::__1::allocator<char> >::~vector() vector:557
    #8 0x1031842fc in std::__1::vector<char, std::__1::allocator<char> >::~vector() vector:552
    #9 0x10318dde8 in std::__1::allocator<std::__1::vector<char, std::__1::allocator<char> > >::destroy(std::__1::vector<char, std::__1::allocator<char> >*) memory:921
    #10 0x10318d728 in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::unset() http.hpp:208
    #11 0x10318f3c8 in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::~Optional() http.hpp:181
    #12 0x10318aabc in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::~Optional() http.hpp:180
    #13 0x10319062c in HTTP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:95
    #14 0x10329c9bc in CGIP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:249
    #15 0x1032940c4 in CGIP::CH::ContentType::~ContentType() ControlHeaderHTTP.hpp:249
    #16 0x1032a1698 in CGI::RoutingParameters::~RoutingParameters() CGI.hpp:90
    #17 0x103276318 in CGI::RoutingParameters::~RoutingParameters() CGI.hpp:90
    #18 0x103276ebc in CGI::~CGI() CGI.cpp:90
    #19 0x1032771b0 in CGI::~CGI() CGI.cpp:77
    #20 0x10327722c in CGI::~CGI() CGI.cpp:77
    #21 0x103516830 in EventPollLoop::update() Eventpollloop.cpp:125
    #22 0x103513388 in EventPollLoop::loop() Eventpollloop.cpp:20
    #23 0x103034e70 in HTTPServer::run() HTTPServer.cpp:60
    #24 0x1035bbd20 in main main.cpp:34
    #25 0x1041b10f0 in start+0x204 (dyld:arm64e+0x50f0)

previously allocated by thread T0 here:
    #0 0x1045b8bd8 in wrap__Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4cbd8)
    #1 0x102e62db0 in void* std::__1::__libcpp_operator_new<unsigned long>(unsigned long) new:235
    #2 0x102e62bd0 in std::__1::__libcpp_allocate(unsigned long, unsigned long) new:261
    #3 0x102e7eaa4 in std::__1::allocator<char>::allocate(unsigned long) memory:870
    #4 0x102e7e4dc in std::__1::allocator_traits<std::__1::allocator<char> >::allocate(std::__1::allocator<char>&, unsigned long) allocator_traits.h:260
    #5 0x102e7d368 in std::__1::vector<char, std::__1::allocator<char> >::__vallocate(unsigned long) vector:993
    #6 0x102e7ca60 in std::__1::vector<char, std::__1::allocator<char> >::vector(std::__1::vector<char, std::__1::allocator<char> > const&) vector:1258
    #7 0x102e7c028 in std::__1::vector<char, std::__1::allocator<char> >::vector(std::__1::vector<char, std::__1::allocator<char> > const&) vector:1251
    #8 0x10318dee8 in void std::__1::allocator<std::__1::vector<char, std::__1::allocator<char> > >::construct<std::__1::vector<char, std::__1::allocator<char> >, std::__1::vector<char, std::__1::allocator<char> > const&>(std::__1::vector<char, std::__1::allocator<char> >*, std::__1::vector<char, std::__1::allocator<char> > const&) memory:916
    #9 0x10318dadc in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::set(std::__1::vector<char, std::__1::allocator<char> > const&) http.hpp:215
    #10 0x103189908 in HTTP::Optional<std::__1::vector<char, std::__1::allocator<char> > >::operator=(std::__1::vector<char, std::__1::allocator<char> > const&) http.hpp:223
    #11 0x103371af4 in HTTP::CH::ContentType::set_default_charset(std::__1::vector<char, std::__1::allocator<char> > const&) ControlHeaderHTTP.cpp:259
    #12 0x10328bf88 in CGI::extract_control_headers() CGI.cpp:569
    #13 0x10328ba84 in CGI::analyze_headers(IndexRange) CGI.cpp:505
    #14 0x10328a6c8 in CGI::reach_headers_end(unsigned long, bool) CGI.cpp:487
    #15 0x103285fb8 in CGI::after_injection(bool) CGI.cpp:518
    #16 0x103284ed8 in CGI::perform_receiving(IObserver&) CGI.cpp:415
    #17 0x103282334 in CGI::notify(IObserver&, IObserver::observation_category, unsigned long) CGI.cpp:337
    #18 0x10342385c in RoundTrip::notify_originator(IObserver&, IObserver::observation_category, unsigned long) RoundTrip.cpp:63
    #19 0x1034b253c in Connection::perform_reaction(IObserver&, IObserver::observation_category, unsigned long) Connection.cpp:182
    #20 0x1034b0a84 in Connection::notify(IObserver&, IObserver::observation_category, unsigned long) Connection.cpp:120
    #21 0x103282d58 in CGI::retransmit(IObserver&, IObserver::observation_category, unsigned long) CGI.cpp:370
    #22 0x103282124 in CGI::notify(IObserver&, IObserver::observation_category, unsigned long) CGI.cpp:323
    #23 0x103514ee0 in EventPollLoop::loop() Eventpollloop.cpp:50
    #24 0x103034e70 in HTTPServer::run() HTTPServer.cpp:60
    #25 0x1035bbd20 in main main.cpp:34
    #26 0x1041b10f0 in start+0x204 (dyld:arm64e+0x50f0)

SUMMARY: AddressSanitizer: double-free (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4d018) in wrap__ZdlPv+0x74

Optionalの問題。今のmainには無関係そう。

corvvs commented 2 years ago

228 依存なので優先度下げてよい

おそらく代入演算の不備

corvvs commented 2 years ago
    Optional &operator=(const Optional<T> &other) {
        if (other.is_null()) {
            unset();
        } else {
            set(other.value());
        }
        return *this;
    }

↑この代入演算子を追加するととりあえず直った。