Use C-style comments in C source files #1
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ers such as xlc on AIX).
<
8000
a href="/libevent/libevent/issues/3" class="Link--primary f4 text-bold markdown-title" data-hovercard-type="issue" data-hovercard-url="/libevent/libevent/issues/3/hovercard">
Assertion fail in evdns
#3
Closed
|
Cherrypicked onto the patches-2.0 branch and merged. Thanks! |
Closed
alessandro40
pushed a commit
to alessandro40/libevent
that referenced
this pull request
Jun 26, 2014
Adapt LibEvent to work with Android NDK
azat
added a commit
that referenced
this pull request
Sep 10, 2015
On FreeBSD with kqueue there is a call to evthread_debug_lock_mark_unlocked()
during event_base_free(), that will fail with an assert because of unmatched
"held_by", fix this by reseting lock callbacks to NULL before
event_base_free().
Trace:
bufferevent/bufferevent_pair_release_lock: [warn] Trying to disable lock functions after they have been set up will probaby not work.
[warn] Trying to disable lock functions after they have been set up will probaby not work.
FAIL libevent/test/regress_bufferevent.c:259: lock: lock error[err] libevent/evthread.c:277: Assertion lock->held_by == me failed in evthread_debug_lock_mark_unlocked
[New Thread 802006400 (LWP 100070/regress)]
Program received signal SIGABRT, Aborted.
[Switching to Thread 802006400 (LWP 100070/regress)]
0x000000080167d6ca in thr_kill () from /lib/libc.so.7
(gdb) bt
#0 0x000000080167d6ca in thr_kill () from /lib/libc.so.7
#1 0x0000000801752149 in abort () from /lib/libc.so.7
#2 0x00000000004dff44 in event_exit (errcode=-559030611) at libevent/log.c:105
#3 0x00000000004e053c in event_errx (eval=-559030611, fmt=0x5182cc "%s:%d: Assertion %s failed in %s") at libevent/log.c:162
#4 0x00000000004d9954 in evthread_debug_lock_mark_unlocked (mode=0, lock=0x802017060) at libevent/evthread.c:277
#5 0x00000000004d909a in debug_lock_unlock (mode=0, lock_=0x802017060) at libevent/evthread.c:290
#6 0x00000000004e132c in evsig_dealloc_ (base=0x80201e300) at libevent/signal.c:434
#7 0x00000000004e36c1 in kq_dealloc (base=0x80201e300) at libevent/kqueue.c:435
#8 0x00000000004c9a44 in event_base_free_ (base=0x80201e300, run_finalizers=1) at libevent/event.c:855
#9 0x00000000004c931a in event_base_free (base=0x0) at libevent/event.c:887
#10 0x0000000000452657 in lock_unlock_free_thread_cbs () at libevent/test/regress_bufferevent.c:279
#11 0x0000000000452621 in free_lock_unlock_profiler (data=0x8020170a0) at libevent/test/regress_bufferevent.c:317
#12 0x000000000044bc8f in test_bufferevent_pair_release_lock (arg=0x8020170a0) at libevent/test/regress_bufferevent.c:334
#13 0x00000000004b2288 in testcase_run_bare_ (testcase=0x737660) at libevent/test/tinytest.c:105
#14 0x00000000004b1e72 in testcase_run_one (group=0x738c90, testcase=0x737660) at libevent/test/tinytest.c:252
#15 0x00000000004b2930 in tinytest_main (c=3, v=0x7fffffffead0, groups=0x738c20) at libevent/test/tinytest.c:434
#16 0x00000000004982fe in main (argc=3, argv=0x7fffffffead0) at libevent/test/regress_main.c:459
(gdb) f 4
#4 0x00000000004d9954 in evthread_debug_lock_mark_unlocked (mode=0, lock=0x802017060) at libevent/evthread.c:277
277 EVUTIL_ASSERT(lock->held_by == me);
Current language: auto; currently minimal
(gdb) p lock
$1 = (struct debug_lock *) 0x802017060
(gdb) p lock->held_by
$2 = 0
(gdb) p me
$3 = 34393318400
azat
added a commit
that referenced
this pull request
Oct 4, 2015
…l-lock case Sample bt: (gdb) bt #0 0x00000000004a95d2 in evthread_setup_global_lock_ (lock_=0x0, locktype=0, enable_locks=1) #1 0x00000000004afbc7 in evsig_global_setup_locks_ (enable_locks=1) at signal.c:475 #2 0x00000000004a5da8 in event_global_setup_locks_ (enable_locks=1) at event.c:3838 #3 0x00000000004a8983 in evthread_set_lock_callbacks (cbs=0x7fffffffdde0) at evthread.c:129 #4 0x0000000000445a8f in use_lock_unlock_profiler () at regress_bufferevent.c:306 #5 0x0000000000445af2 in test_bufferevent_pair_release_lock (arg=0x70e710) at regress_bufferevent.c:327 #6 0x000000000048c9a8 in testcase_run_bare_ (testcase=0x6fdc10 <bufferevent_testcases+80>) at tinytest.c:105 #7 0x000000000048cc8a in testcase_run_one (group=0x6ff270 <testgroups+112>, testcase=0x6fdc10 <bufferevent_testcases+80>) at tinytest.c:252 #8 0x000000000048d5c9 in tinytest_main (c=3, v=0x7fffffffe008, groups=0x6ff200 <testgroups>) at tinytest.c:434 #9 0x000000000047a08f in main (argc=3, argv=0x7fffffffe008) at regress_main.c:459 Found-with: regress bufferevent/bufferevent_pair_release_lock (-DEVENT__DISABLE_DEBUG_MODE=ON)
azat
added a commit
that referenced
this pull request
Nov 18, 2015
Otherwise we can trigger incorrect callback, the simplest way to trigger this
is using http regression tests -- https_chunk_out, since all it do is:
evhttp_send_reply_end()
evbuffer_add()
do_write()
evhttp_write_buffer()
evcon->cb = cb
And indeed this is what happens:
(gdb) bt
#0 do_write (bev_ssl=0x738a90, atmost=16384) at bufferevent_openssl.c:717
#1 0x00000000004b69f7 in consider_writing (bev_ssl=0x738a90) at bufferevent_openssl.c:875
#2 0x00000000004b7386 in be_openssl_outbuf_cb (buf=0x7387b0, cbinfo=0x7fffffffd590, arg=0x738a90) at bufferevent_openssl.c:1147
#3 0x0000000000490100 in evbuffer_run_callbacks (buffer=0x7387b0, running_deferred=0) at buffer.c:508
#4 0x00000000004901e5 in evbuffer_invoke_callbacks_ (buffer=0x7387b0) at buffer.c:529
#5 0x0000000000493a30 in evbuffer_add (buf=0x7387b0, data_in=0x4ecfb2, datlen=5) at buffer.c:1803
#6 0x00000000004be2e3 in evhttp_send_reply_end (req=0x7371a0) at http.c:2794
#7 0x000000000045c407 in http_chunked_trickle_cb (fd=-1, events=1, arg=0x75aaf0) at regress_http.c:402
...
(gdb) p bev.writecb
$4 = (bufferevent_data_cb) 0x4ba17e <evhttp_write_cb>
$5 = (void *) 0x7379b0
(gdb) p (struct evhttp_connection *)bev.cbarg
$6 = (struct evhttp_connection *) 0x7379b0
(gdb) p $6->cb
$7 = (void (*)(struct evhttp_connection *, void *)) 0x0
And be_sock don't do like this anyway.
Fixes: https_chunk_out
azat
added a commit
that referenced
this pull request
Nov 18, 2015
Since during ssl handshake we can read too, and if something nasty will happens
during this handshake (because of too many events in the loop of something like
this) we can wait forever since there is no read timeout:
(gdb) p *$2.task.connection.bufev
$11 = {
...
be_ops = 0x7f78c2864b00 <bufferevent_ops_openssl>,
ev_read = {
...
ev_ = {
ev_io = {
...
ev_timeout = { tv_sec = 0, tv_usec = 0 }
},
ev_signal = { ... }
},
ev_events = 82, ev_res = 2,
ev_timeout = { tv_sec = 10889976, tv_usec = 418753 }
},
ev_write = {
...
ev_ = {
ev_io = {
...
ev_timeout = { tv_sec = 20, tv_usec = 0 }
},
ev_signal = { ... }
},
ev_events = 84, ev_res = 4,
ev_timeout = { tv_sec = 10889977, tv_usec = 598753 }
},
...
errorcb = 0x7f78c287de70 <evhttp_connection_cb>,
...
timeout_read = { tv_sec = 0, tv_usec = 0 },
timeout_write = { tv_sec = 20, tv_usec = 0 },
enabled = 4
}
(gdb) bt
#0 0x00007f78c17c3633 in __epoll_wait_nocancel () at syscall-template.S:81
#1 0x00007f78c2aaf508 in epoll_dispatch (base=0x18f76d0, tv=<optimized out>) at epoll.c:463
...
Found-with: massive crawling
Tested-with: massive crawling
azat
added a commit
that referenced
this pull request
Dec 1, 2015
If you use bufferevent_socket_connect_hostname() to resolve, then ipv4 answer
can be returned before ipv6 scheduled and if you will destroy bufferevent after
ipv4 answer will come (in a separate thread of course) then ipv6 will trigger
UAF:
$ a.out
=================================================================
==29733==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000ef50 at pc 0x0000004b7aef bp 0x7fffffffd940 sp 0x7fffffffd0f8
READ of size 2 at 0x60200000ef50 thread T0
#0 0x4b7aee in __interceptor_index (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x4b7aee)
#1 0x5060eb in string_num_dots /src/oss/libevent/libevent-github/.cmake-debug/../evdns.c:2739
#2 0x5078df in search_request_new /src/oss/libevent/libevent-github/.cmake-debug/../evdns.c:3214
#3 0x506afd in evdns_base_resolve_ipv6 /src/oss/libevent/libevent-github/.cmake-debug/../evdns.c:2935
#4 0x50aa94 in evdns_getaddrinfo /src/oss/libevent/libevent-github/.cmake-debug/../evdns.c:4719
#5 0x51de4f in evutil_getaddrinfo_async_ /src/oss/libevent/libevent-github/.cmake-debug/../evutil.c:1567
#6 0x4fe023 in bufferevent_socket_connect_hostname /src/oss/libevent/libevent-github/.cmake-debug/../bufferevent_sock.c:519
#7 0x524f54 in evhttp_connection_connect_ /src/oss/libevent/libevent-github/.cmake-debug/../http.c:2493
#8 0x525156 in evhttp_make_request /src/oss/libevent/libevent-github/.cmake-debug/../http.c:2548
#9 0x52d373 in main (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x52d373)
#10 0x7ffff6849b44 in __libc_start_main /tmp/buildd/glibc-2.19/csu/libc-start.c:287
#11 0x445806 in _start (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x445806)
0x60200000ef50 is located 0 bytes inside of 15-byte region [0x60200000ef50,0x60200000ef5f)
freed by thread T1 here:
#0 0x4cc4f2 in __interceptor_free (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x4cc4f2)
#1 0x5141c1 in event_mm_free_ /src/oss/libevent/libevent-github/.cmake-debug/../event.c:3512
#2 0x522402 in evhttp_connection_free /src/oss/libevent/libevent-github/.cmake-debug/../http.c:1206
#3 0x52cc5f in connection_closer (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x52cc5f)
#4 0x50e80e in event_process_active_single_queue /src/oss/libevent/libevent-github/.cmake-debug/../event.c:1642
#5 0x50ed57 in event_process_active /src/oss/libevent/libevent-github/.cmake-debug/../event.c:1734
#6 0x50f458 in event_base_loop /src/oss/libevent/libevent-github/.cmake-debug/../event.c:1957
#7 0x50eddf in event_base_dispatch /src/oss/libevent/libevent-github/.cmake-debug/../event.c:1768
#8 0x52d075 in event_dispatch_thread (/src/oss/libevent/libevent-github/.invest/217-evhttp-threaded/a.out+0x52d075)
#9 0x7ffff74fc0a3 in start_thread /tmp/buildd/glibc-2.19/nptl/pthread_create.c:309
Fixes: #217
Closes: #222
Closes: #219
Gist: https://gist.github.com/azat/92cbb34232ac02d7972b (from #217 but thread-safe)
Closed
azat
pushed a commit
that referenced
this pull request
Aug 14, 2017
Detected using ThreadSanitizer, resolved by capturing the value of ev_res in a local variable while the event is locked, then passing that captured variable to the callback. TSAN report: I0728 14:35:09.822118 WARNING: ThreadSanitizer: data race (pid=815501) I0728 14:35:09.822186 Write of size 2 at 0x7b2c00001bf2 by thread T80 (mutexes: write M1110835549570434736): I0728 14:35:09.822248 #0 event_active_nolock_ libevent/event.c:2893:14 (0a2b90577e830d775300664df77d0b91+0x1fdab28) I0728 14:35:09.822316 #1 event_active libevent/event.c:2858:2 (0a2b90577e830d775300664df77d0b91+0x1fdd10e) I0728 14:35:09.822379 #2 Envoy::Event::TimerImpl::enableTimer(std::chrono::duration<long, std::ratio<1l, 1000l> > const&) envoy/source/common/event/timer_impl.cc:24:5 (0a2b90577e830d775300664df77d0b91+0x459fa0) ... I0728 14:35:09.824146 Previous read of size 2 at 0x7b2c00001bf2 by main thread: I0728 14:35:09.824232 #0 event_process_active_single_queue libevent/event.c:1646:33 (0a2b90577e830d775300664df77d0b91+0x1fdf83d) I0728 14:35:09.824350 #1 event_process_active libevent/event.c (0a2b90577e830d775300664df77d0b91+0x1fd9ad8) I0728 14:35:09.824445 #2 event_base_loop libevent/event.c:1961 (0a2b90577e830d775300664df77d0b91+0x1fd9ad8) I0728 14:35:09.824550 #3 Envoy::Event::DispatcherImpl::run(Envoy::Event::Dispatcher::RunType) envoy/source/common/event/dispatcher_impl.cc:166:3 (0a2b90577e830d775300664df77d0b91+0x4576d9) ... Fixes: #543 (pull-request)
azat
pushed a commit
that referenced
this pull request
Sep 11, 2017
a backtrace of the process without this patch : * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP * frame #0: 0x00007fffb1fb7d96 libsystem_kernel.dylib`kevent + 10 frame #1: 0x0000000108ed0a58 libevent-2.2.1.dylib`kq_dispatch + 696 frame #2: 0x0000000108ec53d8 libevent-2.2.1.dylib`event_base_loop + 696 frame #3: 0x0000000108e1763b regress`test_fork + 1931 frame #4: 0x0000000108e5c7ad regress`run_legacy_test_fn + 45 frame #5: 0x0000000108e690aa regress`testcase_run_one + 858 frame #6: 0x0000000108e6954f regress`tinytest_main + 495 frame #7: 0x0000000108e5c94b regress`main + 171 frame #8: 0x00007fffb1e88235 libdyld.dylib`start + 1 frame #9: 0x00007fffb1e88235 libdyld.dylib`start + 1 Issue: #546
isaachier
pushed a commit
to isaachier/libevent
that referenced
this pull request
Sep 20, 2017
Hunter changes for version 2.1.8.
This was referenced Mar 18, 2020
azat
added a commit
that referenced
this pull request
Jun 25, 2020
evutil.c:2559:1: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
#0 0x4f2be0 in EVUTIL_ISXDIGIT_ libevent/evutil.c:2559:1
#1 0x4bd689 in regname_ok libevent/http.c:4838:7
#2 0x4bc16b in parse_authority libevent/http.c:4958:9
#3 0x4bb8b5 in evhttp_uri_parse_with_flags libevent/http.c:5103:7
#4 0x4bb762 in evhttp_uri_parse libevent/http.c:5050:9
#5 0x4b8f41 in evhttp_parse_query_impl libevent/http.c:3505:9
#6 0x4b8ed7 in evhttp_parse_query libevent/http.c:3569:9
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23291
Report: https://oss-fuzz.com/testcase-detail/5670743106125824
azat
added a commit
that referenced
this pull request
Jun 25, 2020
UBSAN reports:
evbuffer/remove_buffer_with_empty3: ../buffer.c:1443:3: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x7ffff6cd0410 in evbuffer_pullup ../buffer.c:1443
#1 0x5555556d68b9 in test_evbuffer_remove_buffer_with_empty3 ../test/regress_buffer.c:408
#2 0x5555557b95ee in testcase_run_bare_ ../test/tinytest.c:173
#3 0x5555557ba048 in testcase_run_one ../test/tinytest.c:333
#4 0x5555557bc0f8 in tinytest_main ../test/tinytest.c:527
#5 0x555555787702 in main ../test/regress_main.c:528
#6 0x7ffff606c001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
#7 0x55555569436d in _start (/src/le/libevent/.cmake-debug/bin/regress+0x14036d)
azat
added a commit
that referenced
this pull request
Jun 25, 2020
…sponse()
In case of OPT pseudo-RR `class` field is treated as a requestor's UDP
payload size, and class will have 512 (DNS_MAX_UDP_SIZE), and data is
NULL:
(gdb) p *item
$4 = {
next = 0x0,
name = 0x602000000130 "",
type = 41,
class = 512,
ttl = 0,
is_name = 0 '\000',
datalen = 0,
data = 0x0
}
And UBSAN will reports:
../evdns.c:2493:5: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x7ffff70b65bb in evdns_server_request_format_response ../evdns.c:2493
#1 0x7ffff70b706b in evdns_server_request_respond ../evdns.c:2529
#2 0x5555557975ab in regress_dns_server_cb ../test/regress_testutils.c:263
#3 0x7ffff70a8489 in request_parse ../evdns.c:1576
#4 0x7ffff70aa445 in server_udp_port_read ../evdns.c:1726
#5 0x7ffff70ac5cc in server_port_ready_callback ../evdns.c:1849
#6 0x7ffff6d3054c in event_persist_closure ../event.c:1645
#7 0x7ffff6d311cd in event_process_active_single_queue ../event.c:1704
#8 0x7ffff6d33258 in event_process_active ../event.c:1805
#9 0x7ffff6d361b5 in event_base_loop ../event.c:2047
#10 0x7ffff6d334ac in event_base_dispatch ../event.c:1839
#11 0x555555739df2 in test_edns ../test/regress_dns.c:2639
#12 0x5555557b9e96 in testcase_run_bare_ ../test/tinytest.c:173
#13 0x5555557ba8f0 in testcase_run_one ../test/tinytest.c:333
#14 0x5555557bc9a0 in tinytest_main ../test/tinytest.c:527
#15 0x555555787faa in main ../test/regress_main.c:528
#16 0x7ffff606c001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
#17 0x55555569436d in _start (/src/le/libevent/.cmake-debug/bin/regress+0x14036d)
azat
added a commit
that referenced
this pull request
Jul 5, 2020
evutil.c:2559:1: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
#0 0x4f2be0 in EVUTIL_ISXDIGIT_ libevent/evutil.c:2559:1
#1 0x4bd689 in regname_ok libevent/http.c:4838:7
#2 0x4bc16b in parse_authority libevent/http.c:4958:9
#3 0x4bb8b5 in evhttp_uri_parse_with_flags libevent/http.c:5103:7
#4 0x4bb762 in evhttp_uri_parse libevent/http.c:5050:9
#5 0x4b8f41 in evhttp_parse_query_impl libevent/http.c:3505:9
#6 0x4b8ed7 in evhttp_parse_query libevent/http.c:3569:9
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23291
Report: https://oss-fuzz.com/testcase-detail/5670743106125824
(cherry picked from commit 37dbb35)
azat
added a commit
that referenced
this pull request
Jul 5, 2020
UBSAN reports:
evbuffer/remove_buffer_with_empty3: ../buffer.c:1443:3: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x7ffff6cd0410 in evbuffer_pullup ../buffer.c:1443
#1 0x5555556d68b9 in test_evbuffer_remove_buffer_with_empty3 ../test/regress_buffer.c:408
#2 0x5555557b95ee in testcase_run_bare_ ../test/tinytest.c:173
#3 0x5555557ba048 in testcase_run_one ../test/tinytest.c:333
#4 0x5555557bc0f8 in tinytest_main ../test/tinytest.c:527
#5 0x555555787702 in main ../test/regress_main.c:528
#6 0x7ffff606c001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
#7 0x55555569436d in _start (/src/le/libevent/.cmake-debug/bin/regress+0x14036d)
(cherry picked from commit a0c642a)
Closed
azat
added a commit
that referenced
this pull request
Oct 22, 2022
@widgetii: " ================================================================= ==985==ERROR: AddressSanitizer: heap-use-after-free on address 0xb24323e5 at pc 0xb6a06f1c bp 0x9fffc694 sp 0x9fffc260 WRITE of size 2 at 0xb24323e5 thread T22 #0 0xb6a06f1b in __interceptor_memcpy.part.43 (/usr/lib/libasan.so.5+0x41f1b) 0xb24323e5 is located 229 bytes inside of 512-byte region [0xb2432300,0xb2432500) freed by thread T0 (app) here: #0 0xb6a849df in free (/usr/lib/libasan.so.5+0xbf9df) #1 0xb64b6e07 in evbuffer_drain (/usr/lib/libevent_core-2.2.so.1+0x9e07) previously allocated by thread T22 here: #0 0xb6a84d17 in __interceptor_malloc (/usr/lib/libasan.so.5+0xbfd17) #1 0xb64b3d1b (/usr/lib/libevent_core-2.2.so.1+0x6d1b) #2 0x61223 in onIceCandidateHandler /home/dima/git/app/src/webrtc/local.c:116 #3 0x19296f in onNewIceLocalCandidate /home/dima/git/webrtc-c/src/source/PeerConnection/PeerConnection.c:471 " * upstream/pr/1360: Remove bad copy-paste Add locks for server WS, fixes #1357
This was referenced Apr 16, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Strict C-style comments are required for compatibility with compilers such as xlc on AIX with the default settings.