View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002079 | GNUnet | cadet service | public | 2012-01-17 16:47 | 2012-02-28 11:05 |
| Reporter | Christian Grothoff | Assigned To | Christian Grothoff | ||
| Priority | urgent | Severity | crash | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Product Version | Git master | ||||
| Target Version | 0.9.2 | Fixed in Version | 0.9.2 | ||
| Summary | 0002079: use after free in GNUNET_MESH_tunnel_destroy (valgrind report) | ||||
| Description | Jan 17 16:44:07-717747 vpn-30062 DEBUG Peer 1A1L disconnected from tunnel. Jan 17 16:44:07-729691 mesh-api-30062 DEBUG mesh: Destroying tunnel ==30062== Invalid read of size 8 ==30062== at 0x52997C2: GNUNET_MESH_tunnel_destroy (mesh_api.c:1319) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Address 0x62cbb48 is 40 bytes inside a block of size 96 free'd ==30062== at 0x4C240FD: free (vg_replace_malloc.c:366) ==30062== by 0x50440EB: GNUNET_xfree_ (common_allocation.c:201) ==30062== by 0x5295FEA: destroy_tunnel (mesh_api.c:434) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== ==30062== Invalid read of size 4 ==30062== at 0x52997CE: GNUNET_MESH_tunnel_destroy (mesh_api.c:1321) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Address 0x62cbb54 is 52 bytes inside a block of size 96 free'd ==30062== at 0x4C240FD: free (vg_replace_malloc.c:366) ==30062== by 0x50440EB: GNUNET_xfree_ (common_allocation.c:201) ==30062== by 0x5295FEA: destroy_tunnel (mesh_api.c:434) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== ==30062== Invalid read of size 4 ==30062== at 0x5299808: GNUNET_MESH_tunnel_destroy (mesh_api.c:1326) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Address 0x62cbb50 is 48 bytes inside a block of size 96 free'd ==30062== at 0x4C240FD: free (vg_replace_malloc.c:366) ==30062== by 0x50440EB: GNUNET_xfree_ (common_allocation.c:201) ==30062== by 0x5295FEA: destroy_tunnel (mesh_api.c:434) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== ==30062== Invalid read of size 8 ==30062== at 0x52958FF: destroy_tunnel (mesh_api.c:390) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Address 0x62cbb48 is 40 bytes inside a block of size 96 free'd ==30062== at 0x4C240FD: free (vg_replace_malloc.c:366) ==30062== by 0x50440EB: GNUNET_xfree_ (common_allocation.c:201) ==30062== by 0x5295FEA: destroy_tunnel (mesh_api.c:434) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== ==30062== Invalid read of size 8 ==30062== at 0x5295BF1: destroy_tunnel (mesh_api.c:415) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Address 0x62cbb28 is 8 bytes inside a block of size 96 free'd ==30062== at 0x4C240FD: free (vg_replace_malloc.c:366) ==30062== by 0x50440EB: GNUNET_xfree_ (common_allocation.c:201) ==30062== by 0x5295FEA: destroy_tunnel (mesh_api.c:434) ==30062== by 0x5299820: GNUNET_MESH_tunnel_destroy (mesh_api.c:1327) ==30062== by 0x4025B0: destroy_tunnel_task (gnunet-service-vpn.c:515) ==30062== by 0x5074681: run_ready (scheduler.c:684) ==30062== by 0x5074E66: GNUNET_SCHEDULER_run (scheduler.c:874) ==30062== by 0x5081F53: GNUNET_SERVICE_run (service.c:1712) ==30062== by 0x40919D: main (gnunet-service-vpn.c:2493) ==30062== Jan 17 16:44:07-730815 vpn-30062 ERROR Assertion failed at mesh_api.c:415. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2012-01-17 16:47 | Christian Grothoff | New Issue | |
| 2012-01-17 16:47 | Christian Grothoff | Status | new => assigned |
| 2012-01-17 16:47 | Christian Grothoff | Assigned To | => Bart Polot |
| 2012-01-17 16:48 | Christian Grothoff | Assigned To | Bart Polot => Christian Grothoff |
| 2012-01-17 16:52 | Christian Grothoff | Note Added: 0005274 | |
| 2012-01-17 16:52 | Christian Grothoff | Status | assigned => resolved |
| 2012-01-17 16:52 | Christian Grothoff | Fixed in Version | => 0.9.2 |
| 2012-01-17 16:52 | Christian Grothoff | Resolution | open => fixed |
| 2012-01-17 16:53 | Christian Grothoff | Target Version | => 0.9.2 |
| 2012-02-28 11:05 | Christian Grothoff | Status | resolved => closed |
| 2014-05-09 18:34 | Christian Grothoff | Category | mesh service => cadet service |
