[ZOOKEEPER-4809] do_completion() use-after-free when log level is debug

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.7.2, 3.8.4, 3.9.2
• Fix Version/s: 3.10.0
• Component/s: c client
• Labels: pull-request-available
• Assignee: fanyang
• Reporter: fanyang
• Created: 20/Feb/24 07:17
• Updated: 18/Oct/24 16:39
• Resolved: 02/Aug/24 05:03

Description

void *do_completion(void *v)
{
    zhandle_t *zh = v;
    // ...
    api_epilog(zh, 0);  // L1
    LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");  // L2
    return 0;
}

When the log level is debug, L2 gets the log calback after zookeeper_close(), causes uaf.

Issue Links

• links to: GitHub Pull Request #2139