From issues-return-1115-archive-asf-public=cust-asf.ponee.io@zookeeper.apache.org Fri Sep 6 15:45:15 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id 5AF92180675 for ; Fri, 6 Sep 2019 17:45:15 +0200 (CEST) Received: (qmail 33435 invoked by uid 500); 7 Sep 2019 03:23:20 -0000 Mailing-List: contact issues-help@zookeeper.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@zookeeper.apache.org Delivered-To: mailing list issues@zookeeper.apache.org Received: (qmail 32605 invoked by uid 99); 7 Sep 2019 03:23:18 -0000 Received: from mailrelay1-us-west.apache.org (HELO mailrelay1-us-west.apache.org) (209.188.14.139) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 07 Sep 2019 03:23:18 +0000 Received: from jira-he-de.apache.org (static.172.67.40.188.clients.your-server.de [188.40.67.172]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id 8B158E3140 for ; Fri, 6 Sep 2019 15:45:09 +0000 (UTC) Received: from jira-he-de.apache.org (localhost.localdomain [127.0.0.1]) by jira-he-de.apache.org (ASF Mail Server at jira-he-de.apache.org) with ESMTP id 185347823A3 for ; Fri, 6 Sep 2019 15:45:06 +0000 (UTC) Date: Fri, 6 Sep 2019 15:45:06 +0000 (UTC) From: "Enrico Olivelli (Jira)" To: issues@zookeeper.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Updated] (ZOOKEEPER-1519) Zookeeper Async calls can reference free()'d memory MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/ZOOKEEPER-1519?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Enrico Olivelli updated ZOOKEEPER-1519: --------------------------------------- Fix Version/s: (was: 3.5.6) > Zookeeper Async calls can reference free()'d memory > --------------------------------------------------- > > Key: ZOOKEEPER-1519 > URL: https://issues.apache.org/jira/browse/ZOOKEEPER-1519 > Project: ZooKeeper > Issue Type: Bug > Components: c client > Affects Versions: 3.3.3, 3.3.6 > Environment: Ubuntu 11.10, Ubuntu packaged Zookeeper 3.3.3 with some backported fixes. > Reporter: Mark Gius > Assignee: Daniel Lescohier > Priority: Major > Fix For: 3.6.0, 3.5.7 > > Attachments: zookeeper-1519.patch > > > zoo_acreate() and zoo_aset() take a char * argument for data and prepare a call to zookeeper. This char * doesn't seem to be duplicated at any point, making it possible that the caller of the asynchronous function might potentially free() the char * argument before the zookeeper library completes its request. This is unlikely to present a real problem unless the freed memory is re-used before zookeeper consumes it. I've been unable to reproduce this issue using pure C as a result. > However, ZKPython is a whole different story. Consider this snippet: > ok = zookeeper.acreate(handle, path, json.dumps(value), > acl, flags, callback) > assert ok == zookeeper.OK > In this snippet, json.dumps() allocates a string which is passed into the acreate(). When acreate() returns, the zookeeper request has been constructed with a pointer to the string allocated by json.dumps(). Also when acreate() returns, that string is now referenced by 0 things (ZKPython doesn't bump the refcount) and the string is eligible for garbage collection and re-use. The Zookeeper request now has a pointer to dangerous freed memory. > I've been seeing odd behavior in our development environments for some time now, where it appeared as though two separate JSON payloads had been joined together. Python has been allocating a new JSON string in the middle of the old string that an incomplete zookeeper async call had not yet processed. > I am not sure if this is a behavior that should be documented, or if the C binding implementation needs to be updated to create copies of the data payload provided for aset and acreate. -- This message was sent by Atlassian Jira (v8.3.2#803003)