search

zeromq / zeromq4-x

ØMQ 4.x stable release branch - bug fixes only
GNU General Public License v3.0
458 stars 196 forks source link

Memory curruption due to double free #92

Open zeromqprashant opened 10 years ago

zeromqprashant commented 10 years ago

==8804== Thread 4: ==8804== Invalid read of size 1 ==8804== at 0x4A08DAC: memcpy (mc_replace_strmem.c:882) ==8804== by 0x4C78163: zmq::encoder_base_tzmq::v2_encoder_t::encode(unsigned char, unsigned long) (encoder.hpp:113) ==8804== by 0x4C6ABDA: zmq::stream_engine_t::out_event() (stream_engine.cpp:284) ==8804== by 0x4C526AB: zmq::io_thread_t::in_event() (io_thread.cpp:73) ==8804== by 0x4C51551: zmq::epoll_t::loop() (epoll.cpp:165) ==8804== by 0x4C7128A: thread_routine (thread.cpp:81) ==8804== by 0x3F1AA079D0: start_thread (in /lib64/libpthread-2.12.so) ==8804== by 0x3F1A2E8B7C: clone (in /lib64/libc-2.12.so) ==8804== Address 0x54171df is 735 bytes inside a block of size 736 free'd ==8804== at 0x4A063F0: free (vg_replace_malloc.c:446) ==8804== by 0x4C5713B: zmq::msg_t::close() (msg.cpp:141) ==8804== by 0x4C781F0: zmq::encoder_base_tzmq::v2_encoder_t::encode(unsigned char, unsigned long) (encoder.hpp:83) ==8804== by 0x4C6ABDA: zmq::stream_engine_t::out_event() (stream_engine.cpp:284) ==8804== by 0x4C526AB: zmq::io_thread_t::in_event() (io_thread.cpp:73) ==8804== by 0x4C51551: zmq::epoll_t::loop() (epoll.cpp:165) ==8804== by 0x4C7128A: thread_routine (thread.cpp:81) ==8804== by 0x3F1AA079D0: start_thread (in /lib64/libpthread-2.12.so) ==8804== by 0x3F1A2E8B7C: clone (in /lib64/libc-2.12.so) ==8804== ==8804== Invalid free() / delete / delete[] / realloc() ==8804== at 0x4A063F0: free (vg_replace_malloc.c:446) ==8804== by 0x4C5713B: zmq::msg_t::close() (msg.cpp:141) ==8804== by 0x4C781F0: zmq::encoder_base_tzmq::v2_encoder_t::encode(unsigned char, unsigned long) (encoder.hpp:83) ==8804== by 0x4C6ABDA: zmq::stream_engine_t::out_event() (stream_engine.cpp:284) ==8804== by 0x4C526AB: zmq::io_thread_t::in_event() (io_thread.cpp:73) ==8804== by 0x4C51551: zmq::epoll_t::loop() (epoll.cpp:165) ==8804== by 0x4C7128A: thread_routine (thread.cpp:81) ==8804== by 0x3F1AA079D0: start_thread (in /lib64/libpthread-2.12.so) ==8804== by 0x3F1A2E8B7C: clone (in /lib64/libc-2.12.so) ==8804== Address 0x5416f00 is 0 bytes inside a block of size 736 free'd ==8804== at 0x4A063F0: free (vg_replace_malloc.c:446) ==8804== by 0x4C5713B: zmq::msg_t::close() (msg.cpp:141) ==8804== by 0x4C781F0: zmq::encoder_base_tzmq::v2_encoder_t::encode(unsigned char, unsigned long) (encoder.hpp:83) ==8804== by 0x4C6ABDA: zmq::stream_engine_t::out_event() (stream_engine.cpp:284) ==8804== by 0x4C526AB: zmq::io_thread_t::in_event() (io_thread.cpp:73) ==8804== by 0x4C51551: zmq::epoll_t::loop() (epoll.cpp:165) ==8804== by 0x4C7128A: thread_routine (thread.cpp:81) ==8804== by 0x3F1AA079D0: start_thread (in /lib64/libpthread-2.12.so) ==8804== by 0x3F1A2E8B7C: clone (in /lib64/libc-2.12.so)

Valgrind out put.

Socket type router dealer. This happens right after ERROR or AGAIN.

zeromqprashant commented 10 years ago

This happens at client side..

giskook commented 9 years ago

@zeromqprashant I have meet the same problem. I check my code. Because I use one zmq socket in more than one thread.Hope it helps.