Custom Query (2195 matches)

See ​this report on mailing list.

Test log:

pjnath: 14:22:57.065 Running ice_test()...
 14:22:57.065     Basic with host candidates
 14:22:58.186     Basic with host candidates, 4 components
 14:22:58.199     err: pj_ice_strans_start_ice(): [pj_status_t=70010] Too many objects of the specified type (PJ_ETOOMANY)
 14:22:58.699 ..ERROR(-120)

Using IoCompletionPort (IOCP) ioqueue backend, which is the default backend on Win32 on Release build, may lead to write access to memory area that has been freed before. This potentially could crash the application, or random memory corruption.

This symptom can be detected with Visual Studio 2005 (but not with Visual Studio 6).

Explanation about this bug is as follows.

1. When socket is closed, Windows automatically unregisters the socket from the IOCP. Any pending operations to the socket are also cancelled.
2. But when the next time the IOCP is polled with GetQueuedCompletionStatus(), Windows would still report an event to the pending operations that have been cancelled above.
3. If the memory that corresponds to the WSAOVERLAPPED structure that was registered for the asynchronous operation has been freed (for example, the pool is released), Windows will write some values to these area that was previously occupied by the WSAOVERLAPPED structure.