Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When Abnormal Interruption,Could lead to use after free #180

Closed
xlshaoscu opened this issue Apr 28, 2022 · 1 comment
Closed

When Abnormal Interruption,Could lead to use after free #180

xlshaoscu opened this issue Apr 28, 2022 · 1 comment

Comments

@xlshaoscu
Copy link

xlshaoscu commented Apr 28, 2022

Hi,All
I now use v0.17.3 uWebSockets, when the websockets interruption,meet the UAF,so I upgrade to 20.0.0 uWebSockets。the question still exists and the problem is same。the asan output like this:
==51==ERROR: AddressSanitizer: heap-use-after-free on address 0xffff93337690 at pc 0xffffa8299868 bp 0xffffa5bf2e10 sp 0xffffa5bf2e30
READ of size 8 at 0xffff93337690 thread T2
#0 0xffffa8299867 in us_socket_context src/socket.c:51
#1 0xffffa826bd2f in uWS::WebSocket<true, true, MTS::PerSocketData>::send(std::basic_string_view<char, std::char_traits >, uWS::OpCode, bool) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/WebSocket.h:79
#2 0xffffa823c013 in operator() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WSockectManager.cpp:495
#3 0xffffa823c013 in __invoke_impl<void, MTS::WSockectManager::SendData(int, std::__cxx11::string&)::<lambda()>&> /usr/include/c++/7/bits/invoke.h:60
#4 0xffffa823c013 in __invoke<MTS::WSockectManager::SendData(int, std::__cxx11::string&)::<lambda()>&> /usr/include/c++/7/bits/invoke.h:95
#5 0xffffa823c013 in invoke<MTS::WSockectManager::SendData(int, std::__cxx11::string&)::<lambda()>&> /usr/include/c++/7/functional:80
#6 0xffffa823c013 in call /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:152
#7 0xffffa82510ef in ofats::any_detail::any_invocable_impl<void, false>::call() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:247
#8 0xffffa82510ef in ofats::any_invocable<void ()>::operator()() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:354
#9 0xffffa82510ef in uWS::Loop::wakeupCb(us_loop_t*) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:41
#10 0xffffa82a0c17 in us_internal_dispatch_ready_poll src/loop.c:197
#11 0xffffa82a1713 in us_loop_run src/eventing/epoll_kqueue.c:147
#12 0xffffa82495bf in uWS::Loop::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:166
#13 0xffffa82495bf in uWS::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:183
#14 0xffffa82495bf in uWS::TemplatedApp::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/App.h:393
#15 0xffffa82495bf in MTS::WSockectManager::StartWsServer() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WSockectManager.cpp:345
#16 0xffffa783b1bb (/usr/lib64/libstdc++.so.6+0xbe1bb)
#17 0xffffb60317af (/usr/lib64/libpthread.so.0+0x87af)
#18 0xffffb5e7521b (/usr/lib64/libc.so.6+0xd521b)

0xffff93337690 is located 16 bytes inside of 201-byte region [0xffff93337680,0xffff93337749)
freed by thread T2 here:
#0 0xffffb64ccb37 in free (/home/mts/lib/libasan.so.4+0xcfb37)
#1 0xffffa829e15b in us_internal_free_closed_sockets src/loop.c:162
#2 0xffffa829e1bb in us_internal_loop_post src/loop.c:185
#3 0xffffa82a16bf in us_loop_run src/eventing/epoll_kqueue.c:152
#4 0xffffa82495bf in uWS::Loop::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:166
#5 0xffffa82495bf in uWS::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:183
#6 0xffffa82495bf in uWS::TemplatedApp::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/App.h:393
#7 0xffffa82495bf in MTS::WSockectManager::StartWsServer() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WSockectManager.cpp:345
#8 0xffffa783b1bb (/usr/lib64/libstdc++.so.6+0xbe1bb)
#9 0xffffb60317af (/usr/lib64/libpthread.so.0+0x87af)
#10 0xffffb5e7521b (/usr/lib64/libc.so.6+0xd521b)

previously allocated by thread T2 here:
#0 0xffffb64cd2a3 in __interceptor_realloc (/home/mts/lib/libasan.so.4+0xd02a3)
#1 0xffffa829dfd3 in us_poll_resize src/eventing/epoll_kqueue.c:208
#2 0xffffa82a1847 in us_socket_context_adopt_socket src/context.c:264
#3 0xffffa826809b in void uWS::HttpResponse::upgradeMTS::PerSocketData(MTS::PerSocketData&&, std::basic_string_view<char, std::char_traits >, std::basic_string_view<char, std::char_traits >, std::basic_string_view<char, std::char_traits >, us_socket_context_t*) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpResponse.h:285
#4 0xffffa826a7ff in ZZN3uWS12TemplatedAppILb1EE2wsIN3MTS13PerSocketDataEEEOS1_NSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEONS1_17WebSocketBehaviorIT_EEENUlPSD_PT0_E0_clINS_12HttpResponseILb1EEENS_11HttpRequestEEEDaSG_SI /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/App.h:276
#5 0xffffa826a7ff in void std::__invoke_impl<void, uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse, uWS::HttpRequest>(std::__invoke_other, uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse&&, uWS::HttpRequest&&) /usr/include/c++/7/bits/invoke.h:60
#6 0xffffa826a7ff in std::__invoke_result<uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse, uWS::HttpRequest>::type std::__invoke<uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse, uWS::HttpRequest>(uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, (std::__invoke_result&&)...) /usr/include/c++/7/bits/invoke.h:95
#7 0xffffa826a7ff in std::invoke_result<uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse, uWS::HttpRequest>::type std::invoke<uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, uWS::HttpResponse, uWS::HttpRequest>(uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}&, (std::invoke_result&&)...) /usr/include/c++/7/functional:80
#8 0xffffa826a7ff in ofats::any_detail::handler_traits<void, uWS::HttpResponse, uWS::HttpRequest>::large_handler<uWS::TemplatedApp&& uWS::TemplatedApp::wsMTS::PerSocketData(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, uWS::TemplatedApp::WebSocketBehaviorMTS::PerSocketData&&)::{lambda(auto:1*, auto:2*)#2}>::call(ofats::any_detail::storage&, uWS::HttpResponse, uWS::HttpRequest) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:152
#9 0xffffa826379f in ofats::any_detail::any_invocable_impl<void, false, uWS::HttpResponse, uWS::HttpRequest>::call(uWS::HttpResponse, uWS::HttpRequest) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:247
#10 0xffffa826379f in ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest)>::operator()(uWS::HttpResponse, uWS::HttpRequest) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:354
#11 0xffffa826379f in ZZN3uWS11HttpContextILb1EE6onHttpENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES7_ON5ofats13any_invocableIFvPNS_12HttpResponseILb1EEEPNS_11HttpRequestEEEEbENUlPT_E_clINS_10HttpRouterINS_15HttpContextDataILb1EE10RouterDataEEEEEDaSJ /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpContext.h:417
#12 0xffffa826379f in bool std::__invoke_impl<bool, uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>>(std::__invoke_other, uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>&&) /usr/include/c++/7/bits/invoke.h:60
#13 0xffffa826379f in std::__invoke_result<uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse
, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>>::type std::__invoke<uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>>(uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, (std::__invoke_result&&)...) /usr/include/c++/7/bits/invoke.h:96
#14 0xffffa826379f in std::invoke_result<uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>>::type std::invoke<uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, uWS::HttpRouter<uWS::HttpContextData::RouterData>>(uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}&, (std::invoke_result&&)...) /usr/include/c++/7/functional:81
#15 0xffffa826379f in ofats::any_detail::handler_traits<bool, uWS::HttpRouter<uWS::HttpContextData::RouterData>>::large_handler<uWS::HttpContext::onHttp(std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, ofats::any_invocable<void (uWS::HttpResponse, uWS::HttpRequest*)>&&, bool)::{lambda(auto:1*)#1}>::call(ofats::any_detail::storage&, uWS::HttpRouter<uWS::HttpContextData::RouterData>) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:153
#16 0xffffa8271ee7 in ofats::any_detail::any_invocable_impl<bool, false, uWS::HttpRouter<uWS::HttpContextData::RouterData>
>::call(uWS::HttpRouter<uWS::HttpContextData::RouterData>) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:247
#17 0xffffa8271ee7 in ofats::any_invocable<bool (uWS::HttpRouter<uWS::HttpContextData::RouterData>
)>::operator()(uWS::HttpRouter<uWS::HttpContextData::RouterData>) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:354
#18 0xffffa8271ee7 in uWS::HttpRouter<uWS::HttpContextData::RouterData>::executeHandlers(uWS::HttpRouter<uWS::HttpContextData::RouterData>::Node
, int, uWS::HttpContextData::RouterData&) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpRouter.h:176
#19 0xffffa82725c7 in uWS::HttpRouter<uWS::HttpContextData::RouterData>::route(std::basic_string_view<char, std::char_traits >, std::basic_string_view<char, std::char_traits >) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpRouter.h:223
#20 0xffffa82725c7 in uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}::operator()({lambda(us_socket_t*, char*, int)#3}, uWS::HttpRequest) const /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpContext.h:161
#21 0xffffa82725c7 in void* std::__invoke_impl<void*, uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, void*, uWS::HttpRequest>(std::__invoke_other, uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, void*&&, uWS::HttpRequest&&) /usr/include/c++/7/bits/invoke.h:60
#22 0xffffa82725c7 in std::__invoke_result<uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, {lambda(us_socket_t*, char*, int)#3}, uWS::HttpRequest>::type std::__invoke<uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, {lambda(us_socket_t*, char*, int)#3}, uWS::HttpRequest>(uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, (std::__invoke_result&&)...) /usr/include/c++/7/bits/invoke.h:96
#23 0xffffa82725c7 in std::invoke_result<uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, {lambda(us_socket_t*, char*, int)#3}, uWS::HttpRequest>::type std::invoke<uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, {lambda(us_socket_t*, char*, int)#3}, uWS::HttpRequest>(uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}&, (std::invoke_result&&)...) /usr/include/c++/7/functional:81
#24 0xffffa82725c7 in ofats::any_detail::handler_traits<void*, void*, uWS::HttpRequest*>::small_handler<uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const::{lambda(void*, uWS::HttpRequest*)#1}>::call(ofats::any_detail::storage&, void*, uWS::HttpRequest*) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:134
#25 0xffffa8260c87 in ofats::any_detail::any_invocable_impl<void*, false, void*, uWS::HttpRequest*>::call(void*, uWS::HttpRequest*) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:247
#26 0xffffa8260c87 in ofats::any_invocable<void* (void*, uWS::HttpRequest*)>::operator()(void*, uWS::HttpRequest*) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/MoveOnlyFunction.h:354
#27 0xffffa8260c87 in std::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>(char*, unsigned int, void*, void*, uWS::HttpRequest*, ofats::any_invocable<void* (void*, uWS::HttpRequest*)>&, ofats::any_invocable<void* (void*, std::basic_string_view<char, std::char_traits >, bool)>&) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpParser.h:253
#28 0xffffa8260c87 in uWS::HttpParser::consumePostPadded(char*, unsigned int, void*, void*, ofats::any_invocable<void* (void*, uWS::HttpRequest*)>&&, ofats::any_invocable<void* (void*, std::basic_string_view<char, std::char_traits >, bool)>&&, ofats::any_invocable<void* (void*)>&&) /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpParser.h:368
#29 0xffffa8265843 in uWS::HttpContext::init()::{lambda(us_socket_t*, char*, int)#3}::operator()(us_socket_t*, char*, int) const /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/HttpContext.h:136
#30 0xffffa82a08e7 in ssl_on_data src/crypto/openssl.c:266
#31 0xffffa82a0ec3 in us_internal_dispatch_ready_poll src/loop.c:324
#32 0xffffa82a1713 in us_loop_run src/eventing/epoll_kqueue.c:147
#33 0xffffa82495bf in uWS::Loop::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:166
#34 0xffffa82495bf in uWS::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/Loop.h:183
#35 0xffffa82495bf in uWS::TemplatedApp::run() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../opensource/uWebSockets/ascend-ci/output/include/App.h:393
#36 0xffffa82495bf in MTS::WSockectManager::StartWsServer() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WSockectManager.cpp:345
#37 0xffffa783b1bb (/usr/lib64/libstdc++.so.6+0xbe1bb)
#38 0xffffb60317af (/usr/lib64/libpthread.so.0+0x87af)
#39 0xffffb5e7521b (/usr/lib64/libc.so.6+0xd521b)

Thread T2 created by T0 here:
#0 0xffffb64359a7 in pthread_create (/home/mts/lib/libasan.so.4+0x389a7)
#1 0xffffa783b503 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_deletestd::thread::_State >, void ()()) (/usr/lib64/libstdc++.so.6+0xbe503)
#2 0xffffa823c383 in std::thread::thread<void (MTS::WSockectManager::
)(), MTS::WSockectManager*>(void (MTS::WSockectManager::&&)(), MTS::WSockectManager&&) /usr/include/c++/7/thread:126
#3 0xffffa823c383 in std::_MakeUniqstd::thread::__single_object std::make_unique<std::thread, void (MTS::WSockectManager::)(), MTS::WSockectManager>(void (MTS::WSockectManager::&&)(), MTS::WSockectManager&&) /usr/include/c++/7/bits/unique_ptr.h:825
#4 0xffffa823c383 in MTS::WSockectManager::Start() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WSockectManager.cpp:243
#5 0xffffa828ab27 in MTS::WebSocketServer::Start() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/WebSocketServer.cpp:44
#6 0xffffa823916b in MTS::SenderManager::Start() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Server/SenderManager.cpp:33
#7 0xffffa81bf713 in MTS::Manager::Start() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Manager/Manager.cpp:68
#8 0xffffa81c055f in MTS::Manager::Init() /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Manager/Manager.cpp:62
#9 0xffffa81a6f8b in Init /usr1/workspace/sxl/MediaTransferService_NewVersion/build_script/../src/cpp/Interface/Interface.cpp:63
#10 0xffffb33b1177 (/usr/lib64/libffi.so.7+0x6177)
#11 0xffffb33b076b (/usr/lib64/libffi.so.7+0x576b)
#12 0xffffb33ddf83 in _ctypes_callproc (/usr/lib64/python3.7/lib-dynload/_ctypes.cpython-37m-aarch64-linux-gnu.so+0x11f83)
#13 0xffffb33d715b (/usr/lib64/python3.7/lib-dynload/_ctypes.cpython-37m-aarch64-linux-gnu.so+0xb15b)
#14 0xffffb614c183 in _PyObject_FastCallKeywords (/usr/lib64/libpython3.7m.so.1.0+0x95183)
#15 0xffffb6129c2f in _PyEval_EvalFrameDefault (/usr/lib64/libpython3.7m.so.1.0+0x72c2f)
#16 0xffffb6122b6b (/usr/lib64/libpython3.7m.so.1.0+0x6bb6b)
#17 0xffffb612c2a7 in _PyEval_EvalFrameDefault (/usr/lib64/libpython3.7m.so.1.0+0x752a7)
#18 0xffffb62035bb in _PyEval_EvalCodeWithName (/usr/lib64/libpython3.7m.so.1.0+0x14c5bb)
#19 0xffffb62036ff in PyEval_EvalCodeEx (/usr/lib64/libpython3.7m.so.1.0+0x14c6ff)
#20 0xffffb620373b in PyEval_EvalCode (/usr/lib64/libpython3.7m.so.1.0+0x14c73b)
#21 0xffffb622e017 (/usr/lib64/libpython3.7m.so.1.0+0x177017)
#22 0xffffb6230787 in PyRun_FileExFlags (/usr/lib64/libpython3.7m.so.1.0+0x179787)
#23 0xffffb623092f in PyRun_SimpleFileExFlags (/usr/lib64/libpython3.7m.so.1.0+0x17992f)
#24 0xffffb624ce3b (/usr/lib64/libpython3.7m.so.1.0+0x195e3b)
#25 0xffffb624d17b in _Py_UnixMain (/usr/lib64/libpython3.7m.so.1.0+0x19617b)
#26 0xffffb5dc3f7f in __libc_start_main (/usr/lib64/libc.so.6+0x23f7f)
#27 0xaaaaea590923 in _start (/usr/bin/python3.7+0x923)

SUMMARY: AddressSanitizer: heap-use-after-free src/socket.c:51 in us_socket_context
Shadow bytes around the buggy address:
0x200ff2666e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff2666e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff2666ea0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x200ff2666eb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff2666ec0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x200ff2666ed0: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff2666ee0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x200ff2666ef0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x200ff2666f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff2666f10: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff2666f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==51==ABORTING

who knows what this is

@xlshaoscu xlshaoscu changed the title When Abnormal Interruption,Could lead to UAF When Abnormal Interruption,Could lead to use after free Apr 28, 2022
@ghost
Copy link

ghost commented May 4, 2022

You are not handling on_close properly. You cannot use a socket after it has been closed.

@ghost ghost closed this as completed Jul 24, 2022
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant