[ZOOKEEPER-3697] zoo_amulti can attempt to free invalid memory after marshalling errors.

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 3.4.14, 3.5.6
• Component/s: c client
• Assignee: Unassigned
• Reporter: Jeremy Sowden
• Created: 13/Jan/20 14:53
• Updated: 13/Feb/20 08:49

Description

zoo_amulti only initializes request objects if rc == ZOK, but it unconditionally calls free_duplicate_path.  For example:

             case ZOO_CHECK_OP: {
                struct CheckVersionRequest req;
                rc = rc < 0 ? rc : CheckVersionRequest_init(zh, &req,
                                        op->check_op.path, op->check_op.version);
                rc = rc < 0 ? rc : serialize_CheckVersionRequest(oa, "req", &req);
                enter_critical(zh);
                entry = create_completion_entry(zh, h.xid, COMPLETION_VOID, op_result_void_completion, result, 0, 0);
                leave_critical(zh);
                free_duplicate_path(req.path, op->check_op.path);
                break;
            }

This means that if there is a marshalling error in one operation, for all the later operations, the request will be initialized, the value of req.path will be undefined, and free_duplicate_path may attempt to free an invalid pointer.