Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix heap corruption when calling ub_ctx_delete in Windows #1157

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

lnzhu
Copy link

@lnzhu lnzhu commented Oct 17, 2024

ub_ctx_delete in libunbound causes heap corruption exception in Windows OS. This issue is only for Windows and discovered when using the lastest libunbound Windows library published here.

  • ub_ctx_delete stops worker thread by ub_stop_bg.
  • When the workder thread exits, tube_remove_bg_listen is called for ctx->qq_pipe and the memory of tube->ev_listen is released in ub_winsock_unregister_wsaevent but tube->ev_listen is never set to NULL.
  • After worker thread stops, tube_delete is called for tx->qq_pipe in ub_ctx_delete.
  • tube_delete calls tube_remove_bg_listen again and it tried to free tube->ev_listen again which leads to heap corruption.
  • I tested multiple older versions (back to 2019) of libunbound Windows library and they all have the same issue.
  • A cleaner way to fix this issue might be setting NULL inside ub_winsock_unregister_wsaevent but it will need to change ub_winsock_unregister_wsaevent API and pass ub_event** instead, which will bring additional changes in different places.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant