[DISPATCH-2199] Cleanup_link code in container.c does not use safe_ptr properly

• Type: Test
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.16.1
• Fix Version/s: 1.17.0
• Component/s: Router Node
• Assignee: Charles E. Rolke
• Reporter: Charles E. Rolke
• Created: 16/Jul/21 13:43
• Updated: 23/Aug/21 15:02
• Resolved: 16/Jul/21 20:43

Description

This code manually performs the function of public interface qd_alloc_deref_safe_ptr() .

        // cleanup any inbound message that has not been forwarded
        qd_message_t *msg = link->incoming_msg.ptr;
        if (msg && qd_alloc_sequence(msg) == link->incoming_msg.seq)
            qd_message_free(msg);

 

Modifications to qd_alloc_deref_safe_ptr are not applied to this code block and will spoil research efforts.

Issue Links

• Discovered while testing: DISPATCH-2095 heap-use-after-free in system_tests_policy_oversize_compound