#205 Segmentation fault in AAA_GroupedJob::Serve()

Hi,

We are using libopendiameter in one of our software projects and have experienced segmentation faults in AAA_GroupedJob::Serve(). I am referring to version 1.0.7g, but it seems to me that the problem also exists in the latest SVN version.

#0 0x084935d5 in ?? ()
#1 0x080ddff7 in AAA_GroupedJob::Serve (this=0x84935d8)
at ../include/framework.h:745
#2 0x080dde47 in AAA_GroupedJob::Serve (this=0x844bbf0)
at ../include/framework.h:737
#3 0x080d71ab in AAA_Task::svc ()
at .../ace/ACE_wrappers/ace/OS_NS_string.inl:47
#4 0xb7b118c3 in ACE_Task_Base::svc_run (args=0x844bb60)
at .../ace/ACE_wrappers/ace/Task.cpp:203
#5 0xb7abfa66 in ACE_Thread_Adapter::invoke_i (this=0x84935d8)
at .../ace/ACE_wrappers/ace/Thread_Adapter.cpp:150
#6 0xb7abf9d1 in ACE_Thread_Adapter::invoke (this=0x844c598)
at .../ace/ACE_wrappers/ace/Thread_Adapter.cpp:93
#7 0xb7a81a82 in ace_thread_adapter (args=0x2e74)
at .../ace/ACE_wrappers/ace/Base_Thread_Adapter.cpp:131
#8 0xb76670c8 in start_thread () from /lib/tls/i686/libpthread.so.0
#9 0xb772aace in clone () from /lib/tls/i686/libc.so.6

We analyzed the problem and found out that an instance of AAA_GroupedJob was deleted while the very same instance was still in AAA_GroupedJob::Serve() in another thread. Calling a member method within Serve() after deletion of the object obviously resulted in the segmentation fault.

I solved the issue by implementing a kind of reference counter that is increased when entering Serve() and decreased when returning from it. The destructor is delayed until the reference counter is 0. (More than one instance of Serve() can be entered in different threads concurrently.) Please find the patch attached.

Can you please comment on this problem?

[Anonymous]

Patch file to solve segmentation fault in AAA_GroupedJob::Serve()