Opened 7 years ago

Closed 7 years ago

#2024 closed defect (fixed)

Fixed crash due to uncancelled timer if there's an error in resolver's query transmit

Reported by: ming Owned by: bennylp
Priority: normal Milestone: release-2.7
Component: pjlib-util Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

In ticket #1953:
Fail to create resolver when library built with IPv6 but run on system without IPv6

If the send count is zero, then transmit_query() will return PJLIB_UTIL_EDNSNOWORKINGNS, however it does so without cancelling the timer, which then will be put back in the list of free timer entries.

    status = transmit_query(resolver, q);
    if (status != PJ_SUCCESS) {
                pj_list_push_back(&resolver->query_free_nodes, q);
                goto on_return;
    }

Thus, it could later result in timer heap corruption and crash after this uncancelled timer is reused and invalidated.

Thanks to Chris Tserng for the fix and Balamurugan Ramajeyam for the report.

Change History (1)

comment:1 Changed 7 years ago by ming

  • Resolution set to fixed
  • Status changed from new to closed

In 5612:

Fixed #2024: Crash due to uncancelled timer if there's an error in resolver's query transmit

Note: See TracTickets for help on using tickets.