libmicrohttpd
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [libmicrohttpd] valgrind reports an invalid write in 0.9.28


From: Christian Grothoff
Subject: Re: [libmicrohttpd] valgrind reports an invalid write in 0.9.28
Date: Wed, 28 Aug 2013 11:43:43 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.12) Gecko/20130116 Icedove/10.0.12

Hi!

I just tested with 0.9.29, and at least there the code compiles for me if I give --disable-epoll to configure to disable epoll support. However, I had to fix a testcase (see SVN 28885) as it used #if LINUX instead of #if EPOLL_SUPPORT and thus failed erroneously.

As for the use-after-free, if you did get valgrind/duma/efence reports, it would be very helpful for my analysis if you could include them in your bugreport (and if you could additionally do this using SVN HEAD, I'd very much appreciate it, but 0.9.28 should suffice if necessary).

Happy hacking!

Christian

On 08/28/2013 09:46 AM, Scott Harrison wrote:
Hi,

I am using libmicrohttpd version 0.9.28 on Linux, I am starting it as
follows:

MHD_start_daemon(MHD_NO_FLAG, port, NULL, NULL, apc, apc_data,
MHD_OPTION_NOTIFY_COMPLETED, rc, rc_data, MHD_OPTION_SOCK_ADDR, &addr,
MHD_OPTION_EXTERNAL_LOGGER, microhttpd_log, NULL, MHD_OPTION_END);

and using libevent to deliver events on sockets, then running
MHD_run_from_select with the appropriate FD sets. Valgrind (and I have
actually confirmed this with duma/electricfence) reports that
MHD_connection_handle_idle (connection.c line 2424)
---------------------------
case MHD_EVENT_LOOP_INFO_BLOCK:
/* we should look at this connection again in the next iteration
of the event loop, as we're waiting on the application */
if (0 == (connection->epoll_state & MHD_EPOLL_STATE_IN_EREADY_EDLL))
{
-> EDLL_insert (daemon->eready_head,
daemon->eready_tail,
connection);
connection->epoll_state |= MHD_EPOLL_STATE_IN_EREADY_EDLL;
}
break;
---------------------------
is writing to memory that has previously been freed. I have been trying
to track down the bug in my code and had a few questions regarding the
libmicrohttpd code. I expanded the above macro and reproduced the issue,
it seems that eready_head is pointing to the freed memory. My first
question is "where are items removed from the eready_head/tail list ?" I
noticed that there is code in MHD_epoll, but that isn't getting used
since I am not using epoll. I tried to turn off epoll at configure time,
but got:

--------------------------------
connection.c: In function 'MHD_connection_handle_idle':
connection.c:2400:29: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2401:22: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2403:4: error: 'struct MHD_Connection' has no member named
'nextE'
connection.c:2403:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2403:4: error: 'struct MHD_Connection' has no member named
'prevE'
connection.c:2403:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2403:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2403:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2403:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2406:14: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2410:29: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2411:22: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2413:4: error: 'struct MHD_Connection' has no member named
'nextE'
connection.c:2413:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2413:4: error: 'struct MHD_Connection' has no member named
'prevE'
connection.c:2413:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2413:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2413:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2413:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2416:14: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2422:27: error: 'struct MHD_Connection' has no member named
'epoll_state'
connection.c:2424:4: error: 'struct MHD_Connection' has no member named
'nextE'
connection.c:2424:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2424:4: error: 'struct MHD_Connection' has no member named
'prevE'
connection.c:2424:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2424:4: error: 'struct MHD_Daemon' has no member named
'eready_tail'
connection.c:2424:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2424:4: error: 'struct MHD_Daemon' has no member named
'eready_head'
connection.c:2427:14: error: 'struct MHD_Connection' has no member named
'epoll_state'
------------------------------------

What things should I be checking in my code ? am I using the library
incorrectly ?

Many thanks

Scott.




reply via email to

[Prev in Thread] Current Thread [Next in Thread]