[ZOOKEEPER-4809] do_completion() use-after-free when log level is debug

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Component/s: c client
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: fanyang
• Created: 20/Feb/24 07:17
• Updated: 16/Mar/24 19:21

Description

void *do_completion(void *v)
{
    zhandle_t *zh = v;
    // ...
    api_epilog(zh, 0);  // L1
    LOG_DEBUG(LOGCALLBACK(zh), "completion thread terminated");  // L2
    return 0;
}

When the log level is debug, L2 gets the log calback after zookeeper_close(), causes uaf.

Issue Links

• links to: GitHub Pull Request #2139