#29 XmlRpcDispatch::work iterator invalidation

[stpg]

version xmlrpc++0.7

if server close connection in XmlRpcClient::readHeader(), while processing events in
XmlRpcDispatch::work, iterator thisIt become invalid becouse XmlRpcClient::setupConnection() changes XmlRpcDispatch::_sources container (_disp.removeSource(this) && _disp.addSource(this,...)).

for (it=_sources.begin(); it != _sources.end(); )
{
SourceList::iterator thisIt = it++;
...
if (FD_ISSET(fd, &inFd))
newMask &= src->handleEvent(ReadableEvent);
At this point thisIt can be invalid. And in next code
thisIt->getMask() = newMask;
Access Viovlation occurs.

Bug can still occur in CVS vesrion (XmlRpcDispatch::waitForAndProcessEvents() has similar code)

I've workaround for this bug for xmlrpc++0.7, and it may help developers:

Index: xmlrpc++/include/XmlRpcDispatch.h

--- xmlrpc++/include/XmlRpcDispatch.h (revision 45)
+++ xmlrpc++/include/XmlRpcDispatch.h (working copy)
@@ -81,6 +81,7 @@

bool _doClear;
bool _inWork;
+ bool _iteratorTrashed;

};
} // namespace XmlRpc

Index: xmlrpc++/src/XmlRpcDispatch.cpp

--- xmlrpc++/src/XmlRpcDispatch.cpp (revision 45)
+++ xmlrpc++/src/XmlRpcDispatch.cpp (working copy)
@@ -23,6 +23,7 @@

XmlRpcDispatch::XmlRpcDispatch()
+ : _iteratorTrashed(false)
{
_endTime = -1.0;
_doClear = false;
@@ -40,6 +41,7 @@
XmlRpcDispatch::addSource(XmlRpcSource* source, unsigned mask)
{
_sources.push_back(MonitoredSource(source, mask));
+ _iteratorTrashed = true;
}

// Stop monitoring this source. Does not close the source.
@@ -50,6 +52,7 @@
if (it->getSource() == source)
{
_sources.erase(it);
+ _iteratorTrashed = true;
break;
}
}
@@ -117,11 +120,12 @@
}

// Process events
+ _iteratorTrashed = false;
for (it=_sources.begin(); it != _sources.end(); )
{
SourceList::iterator thisIt = it++;
XmlRpcSource* src = thisIt->getSource();
- int fd = src->getfd();
+ int fd = src->getfd();
unsigned newMask = (unsigned) -1;
if (fd <= maxFd) {
// If you select on multiple event types this could be ambiguous
@@ -132,6 +136,11 @@
if (FD_ISSET(fd, &excFd))
newMask &= src->handleEvent(Exception);

+ if(_iteratorTrashed)
+ {
+ break;
+ }
+
if ( ! newMask) {
_sources.erase(thisIt); // Stop monitoring this one
if ( ! src->getKeepOpen())
@@ -148,7 +157,7 @@
SourceList closeList = _sources;
_sources.clear();
for (SourceList::iterator it=closeList.begin(); it!=closeList.end(); ++it) {
- XmlRpcSource *src = it->getSource();
+ XmlRpcSource *src = it->getSource();
src->close();
}

[Nathan Bowhay]

Hopefully someone is still monitoring this, is this fixed in the latest build: 0.7 zip? Cause I think this is the same bug I am getting, if I call execute several times. If the fix isn't in the latest build where can I get the fix?

[Nathan Bowhay]

I just noticed the build under files is from 2003 and this was posted in 2007 so it obviously wasn't in that build, so how can I get it? will the builds under files be updated anytime soon, 2003 was a while ago.

[Nathan Bowhay]

I think I may have found it is this the patch:https://sourceforge.net/tracker/?func=detail&aid=1094418&group_id=70654&atid=528555

Really wish I new though why the original isn't being maintained, there are tons of patches, would be nice to have a compilation of the good ones in a new version.