Skip to content

Commit

Permalink
ZOOKEEPER-4809: Fix do_completion use-after-free when log level is debug
Browse files Browse the repository at this point in the history
The log callback needs to be obtained from freed zh when the log level
is debug, resulting in used-after-free.
  • Loading branch information
fanyang89 committed Feb 20, 2024
1 parent 7074448 commit b332c1f
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions zookeeper-client/zookeeper-client-c/src/mt_adaptor.c
Original file line number Diff line number Diff line change
Expand Up @@ -468,6 +468,7 @@ void *do_completion(void *v)
#endif
{
zhandle_t *zh = v;
log_callback_fn fn;
api_prolog(zh);
notify_thread_ready(zh);
LOG_DEBUG(LOGCALLBACK(zh), "started completion thread");
Expand All @@ -479,8 +480,9 @@ void *do_completion(void *v)
pthread_mutex_unlock(&zh->completions_to_process.lock);
process_completions(zh);
}
api_epilog(zh, 0);
LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");
fn = LOGCALLBACK(zh);
api_epilog(zh, 0);
LOG_DEBUG(fn, "completion thread terminated");
return 0;
}

Expand Down

0 comments on commit b332c1f

Please sign in to comment.