Uploaded image for project: 'ZooKeeper'
  1. ZooKeeper
  2. ZOOKEEPER-4809

do_completion() use-after-free when log level is debug

    XMLWordPrintableJSON

Details

    Description

      void *do_completion(void *v)
      {
          zhandle_t *zh = v;
          // ...
          api_epilog(zh, 0);  // L1
          LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");  // L2
          return 0;
      }
      

      When the log level is debug, L2 gets the log calback after zookeeper_close(), causes uaf.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              fanyang fanyang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 50m
                  50m