Uploaded image for project: 'hicn'
  1. hicn
  2. HICN-454

Use-after-free during LRU eviction in hicn-light Content Store

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Open
    • Icon: Medium Medium
    • 20.01
    • None
    • hicn/hicn-light
    • None

      ==2786== Invalid read of size 1
      ==2786== at 0x13A55C: contentStoreEntry_HasExpiryTimeTicks (contentStoreEntry.c:91)
      ==2786== by 0x138E22: _evictByStorePolicy (contentStoreLRU.c:203)
      ==2786== by 0x1390B7: _contentStoreLRU_PutContent (contentStoreLRU.c:255)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DAFC: messageProcessor_ReceiveContentObject (messageProcessor.c:734)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== by 0x126169: _receivePacket (udpListener.c:616)
      ==2786== by 0x126388: _readcb (udpListener.c:655)
      ==2786== by 0x5C868F7: ??? (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786== by 0x5C8733E: event_base_loop (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786== by 0x116FF4: dispatcher_Run (dispatcher.c:101)
      ==2786== Address 0x9885084 is 20 bytes inside a block of size 32 free'd
      ==2786== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==2786== by 0x508BA1B: parcStdlibMemory_Deallocate (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x13A47A: contentStoreEntry_Release (contentStoreEntry.c:79)
      ==2786== by 0x138AF2: _hashTableFunction_ContentStoreEntryDestroyer (contentStoreLRU.c:105)
      ==2786== by 0x508067D: parcHashCodeTable_Del (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x138CEF: _contentStoreLRU_PurgeStoreEntry (contentStoreLRU.c:166)
      ==2786== by 0x138EE0: _evictByStorePolicy (contentStoreLRU.c:218)
      ==2786== by 0x1390B7: _contentStoreLRU_PutContent (contentStoreLRU.c:255)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DAFC: messageProcessor_ReceiveContentObject (messageProcessor.c:734)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== Block was alloc'd at
      ==2786== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==2786== by 0x508B9BD: parcStdlibMemory_Allocate (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x508B9E8: parcStdlibMemory_AllocateAndClear (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x13A1C9: contentStoreEntry_Create (contentStoreEntry.c:38)
      ==2786== by 0x1390CE: _contentStoreLRU_PutContent (contentStoreLRU.c:260)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DA51: messageProcessor_ReceiveContentObject (messageProcessor.c:718)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== by 0x126169: _receivePacket (udpListener.c:616)
      ==2786== by 0x126388: _readcb (udpListener.c:655)
      ==2786== by 0x5C868F7: ??? (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786==
      ==2786== Invalid read of size 1
      ==2786== at 0x13A5BF: contentStoreEntry_GetExpiryTimeTicks (contentStoreEntry.c:97)
      ==2786== by 0x138E36: _evictByStorePolicy (contentStoreLRU.c:204)
      ==2786== by 0x1390B7: _contentStoreLRU_PutContent (contentStoreLRU.c:255)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DAFC: messageProcessor_ReceiveContentObject (messageProcessor.c:734)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== by 0x126169: _receivePacket (udpListener.c:616)
      ==2786== by 0x126388: _readcb (udpListener.c:655)
      ==2786== by 0x5C868F7: ??? (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786== by 0x5C8733E: event_base_loop (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786== by 0x116FF4: dispatcher_Run (dispatcher.c:101)
      ==2786== Address 0x9885084 is 20 bytes inside a block of size 32 free'd
      ==2786== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==2786== by 0x508BA1B: parcStdlibMemory_Deallocate (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x13A47A: contentStoreEntry_Release (contentStoreEntry.c:79)
      ==2786== by 0x138AF2: _hashTableFunction_ContentStoreEntryDestroyer (contentStoreLRU.c:105)
      ==2786== by 0x508067D: parcHashCodeTable_Del (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x138CEF: _contentStoreLRU_PurgeStoreEntry (contentStoreLRU.c:166)
      ==2786== by 0x138EE0: _evictByStorePolicy (contentStoreLRU.c:218)
      ==2786== by 0x1390B7: _contentStoreLRU_PutContent (contentStoreLRU.c:255)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DAFC: messageProcessor_ReceiveContentObject (messageProcessor.c:734)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== Block was alloc'd at
      ==2786== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==2786== by 0x508B9BD: parcStdlibMemory_Allocate (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x508B9E8: parcStdlibMemory_AllocateAndClear (in /usr/lib/libparc.so.1.0)
      ==2786== by 0x13A1C9: contentStoreEntry_Create (contentStoreEntry.c:38)
      ==2786== by 0x1390CE: _contentStoreLRU_PutContent (contentStoreLRU.c:260)
      ==2786== by 0x1388CE: contentStoreInterface_PutContent (contentStoreInterface.c:28)
      ==2786== by 0x12DA51: messageProcessor_ReceiveContentObject (messageProcessor.c:718)
      ==2786== by 0x12CB68: messageProcessor_Receive (messageProcessor.c:286)
      ==2786== by 0x1194C2: forwarder_Receive (forwarder.c:435)
      ==2786== by 0x126169: _receivePacket (udpListener.c:616)
      ==2786== by 0x126388: _readcb (udpListener.c:655)
      ==2786== by 0x5C868F7: ??? (in /usr/lib/x86_64-linux-gnu/libevent-2.1.so.6.0.2)
      ==2786==

            micpapal Michele Papalini
            jordan.auge Jordan Augé
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: