Description
Because aeron_client_conductor_check_lingering_resources never updates last_index, if it frees more than one log_buffer, we end up with duplicates in lingering_resources.
Say we start with lingering_resources = [A, B, C, D] and we are going to delete A and B.
As the loop deletes A and B, aeron_array_fast_unordered_remove copies from last_index (D) into the slots previously occupied by A and B.
So we end up with lingering_resources = [D, D]
Next time aeron_client_conductor_check_lingering_resources is called, we can double-free and crash.
I wonder if the same bug is present in other functions, but aeron_client_conductor_check_lingering_resources is the only one I can reliably break.
If you have a proposed fix for this problem it should be easy for me to test it, just let me know.
Thanks!