[ZOOKEEPER-2320] C-client crashes when removing watcher asynchronously in "local" mode

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.5.1
• Component/s: c client
• Labels: pull-request-available remove_watches
• Assignee: Abraham Fine
• Reporter: Hadriel Kaplan
• Created: 12/Nov/15 23:37
• Updated: 16/Dec/18 15:01

Description

The C-client library will crash when invoking the asynchronous zoo_aremove_watchers() API function with the 'local' argument set to 1.

The reason is: if the local argument is 1/true, then the code does 'notify_sync_completion((struct sync_completion *)data);' But casting the 'data' variable to a sync_completion struct pointer is bogus/invalid, and when it's later handles as that struct pointer it's accessing invalid memory.

As a side note: it will work ok when called synchronously through zoo_remove_watchers(), because that function creates a sync_completion struct and passes it to the asynch zoo_aremove_watchers(), but it will not work ok when the asynch function is used directly for the reason stated perviously.

Another side note: the docs state that setting the 'local' flag makes the C-client remove the watcher "even if there is no server connection" - but really it makes the C-client remove the watcher without notifying the server at all, even if the connection to a server is up. (well... that's what it would do if it didn't just crash instead

Issue Links

• is related to: ZOOKEEPER-1919 Update the C implementation of removeWatches to have it match ZOOKEEPER-1910
• links to: GitHub Pull Request #660
• links to: ReviewBoard