Menu

#2650 amfnd: invalid read in mon.cc

5.17.11
fixed
Gary Lee
None
defect
amf
nd
major
False
2017-10-30
2017-10-23
Gary Lee
No

==478== Invalid read of size 8
==478== at 0x1446B0: avnd_send_pid_exit_evt (mon.cc:274)
==478== by 0x1446B0: avnd_mon_pids (mon.cc:325)
==478== by 0x1446B0: avnd_mon_process(void) (mon.cc:355)
==478== by 0x5EBF6D9: start_thread (pthread_create.c:456)
==478== by 0x61DED7E: clone (clone.S:105)
==478== Address 0x8c04558 is 24 bytes inside a block of size 72 free'd
==478== at 0x4C2F25B: operator delete(void
) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==478== by 0x133EF8: avnd_pm_rec_free(ncs_db_link_list_node) (cpm.cc:84)
==478== by 0x56BDD4A: ncs_db_link_list_del (ncsdlib.c:146)
==478== by 0x134025: avnd_comp_pm_rec_del(avnd_cb_tag
, avnd_comp_tag, avnd_pm_rec) (cpm.cc:138)
==478== by 0x144B69: avnd_evt_pid_exit_evh(avnd_cb_tag, avnd_evt_tag) (mon.cc:403)
==478== by 0x141C41: avnd_evt_process (main.cc:658)
==478== by 0x141C41: avnd_main_process() (main.cc:610)
==478== by 0x115D81: main (main.cc:203)
==478== Block was alloc'd at
==478== at 0x4C2E19F: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==478== by 0x134332: avnd_comp_new_rsrc_mon(avnd_cb_tag, avnd_comp_tag, avsv_amf_pm_start_param_tag, SaAisErrorT) (cpm.cc:329)
==478== by 0x134470: avnd_comp_pm_start_process(avnd_cb_tag, avnd_comp_tag, avsv_amf_pm_start_param_tag, SaAisErrorT) (cpm.cc:269)
==478== by 0x134B43: avnd_evt_ava_pm_start_evh(avnd_cb_tag, avnd_evt_tag) (cpm.cc:419)
==478== by 0x141C41: avnd_evt_process (main.cc:658)
==478== by 0x141C41: avnd_main_process() (main.cc:610)
==478== by 0x115D81: main (main.cc:203)

Related

Wiki: ChangeLog-5.17.11

Discussion

  • Gary Lee

    Gary Lee - 2017-10-23
    • status: accepted --> review
     
  • Gary Lee

    Gary Lee - 2017-10-26
    • status: review --> fixed
     
  • Gary Lee

    Gary Lee - 2017-10-26

    commit 20a16ee0e07ec589d79b1204f511384bd6a9c9d7
    Author: Gary Lee gary.lee@dektech.com.au
    Date: Thu Oct 26 13:34:42 2017 +1100

    amfnd: store pid before sending event [#2650]
    
    The event may be processed and pm_rec
    deleted by the main thread, before it is
    read here.
    
     

Log in to post a comment.