pupnp / pupnp

libupnp: Build UPnP-compliant control points, devices, and bridges on several operating systems.
https://pupnp.github.io/pupnp
BSD 3-Clause "New" or "Revised" License
353 stars 117 forks source link

[1.12.1] A crash occurs when the protocol stack is destroyed. #325

Open susuyu opened 3 years ago

susuyu commented 3 years ago

When the UPNP protocol is started and the HTTP get request from the control point is received and processed, if the protocol stack is destroyed and resources are destroyed for example in web_server_destroy, the thread that processes the HTTP get instruction crashes when the gWebMutex is used.

mrjimenez commented 3 years ago

Hi,

Could you please post a running code example of the problem, so that we can objectively deal with it?

Regards, Marcelo.

susuyu commented 3 years ago

This problem occurs occasionally. When a crash occurs, the stack is as follows: backtrace:

      #00 pc 00054502  bionic/libc.so (abort+166)
      #01 pc 0009d783  bionic/libc.so (__fortify_fatal(char const*, ...)+26)
      #02 pc 0009cf8d  bionic/libc.so (HandleUsingDestroyedMutex(pthread_mutex_t*, char const*)+20)
      #03 pc 0009ce79  bionic/libc.so (pthread_mutex_lock+132)
      #04 pc 0001db21  libupnp.so (web_server_callback+2872)

The corresponding functions are web_server_callback() and UpnpFinish(). The location of crash is line 408 of alias_release, the crash code location is as follows:

static void alias_release(
    /*! [in] XML alias object. */
    struct xml_alias_t *alias)
{
    ithread_mutex_lock(&gWebMutex);  ---> crash
    /* ignore invalid alias */
    if (!is_valid_alias(alias)) {
        ithread_mutex_unlock(&gWebMutex);
        return;
    }
mrjimenez commented 3 years ago

There is not much I can imagine here that could be going wrong like this. The crash suggests that the web mutex is corrupted.

Regards, Marcelo.