Open slingamn opened 6 years ago
Another trace:
#0 0x00007f49ee25c428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007f49ee25e02a in __GI_abort () at abort.c:89
#2 0x0000000000412190 in do_panic (signum=11) at main.cc:616
#3 <signal handler called>
#4 0x00007f49ef15a8da in torrent::DhtTransactionSearch::~DhtTransactionSearch (this=0xd8ca190, __in_chrg=<optimized out>) at dht_transaction.cc:309
#5 0x00007f49ef1587a3 in torrent::DhtTransactionFindNode::~DhtTransactionFindNode (this=0xd8ca190, __in_chrg=<optimized out>) at dht_transaction.h:367
#6 torrent::DhtTransactionFindNode::~DhtTransactionFindNode (this=0xd8ca190, __in_chrg=<optimized out>) at dht_transaction.h:367
#7 0x00007f49ef155386 in torrent::DhtServer::add_transaction (this=this@entry=0x1b07460, transaction=transaction@entry=0xd8ca190, priority=priority@entry=2) at dht_server.cc:638
#8 0x00007f49ef155883 in torrent::DhtServer::find_node_next (this=this@entry=0x1b07460, transaction=transaction@entry=0xea8f380) at dht_server.cc:496
#9 0x00007f49ef15627e in torrent::DhtServer::parse_find_node_reply (this=this@entry=0x1b07460, transaction=transaction@entry=0xea8f380, nodes=...) at dht_server.cc:466
#10 0x00007f49ef15648e in torrent::DhtServer::process_response (this=this@entry=0x1b07460, id=..., sa=sa@entry=0x7ffc46ee6bd0, response=...) at dht_server.cc:397
#11 0x00007f49ef15790e in torrent::DhtServer::event_read (this=0x1b07460) at dht_server.cc:793
#12 0x00007f49ef0f4d8a in torrent::PollEPoll::perform (this=this@entry=0x1a708b0) at poll_epoll.cc:185
#13 0x00007f49ef0f4e2d in torrent::PollEPoll::do_poll (this=0x1a708b0, timeout_usec=<optimized out>, flags=<optimized out>) at poll_epoll.cc:224
#14 0x00007f49ef139084 in torrent::thread_base::event_loop (thread=0x1a6be30) at thread_base.cc:174
#15 0x000000000041040e in main (argc=5, argv=<optimized out>) at main.cc:479
Running under valgrind: https://gist.github.com/slingamn/578793a4b7eeffd0a564daa707a2ac1b
indicates that the following line is a source of use-after-frees:
going through this line (I'm running a version based on c167c5a9e0bcf0d, including the patches from #134):
https://github.com/rakshasa/libtorrent/blob/c167c5a9e0bcf0df23ae5efd91396aae0e37eb87/src/dht/dht_transaction.cc#L309