Ticket #2024 (closed defect: fixed)

Opened 3 weeks ago

Last modified 3 weeks ago

Fixed crash due to uncancelled timer if there's an error in resolver's query transmit

Reported by: ming Owned by: bennylp
Priority: normal Milestone: release-2.7
Component: pjlib-util Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported: no

Description

In ticket #1953: Fail to create resolver when library built with IPv6 but run on system without IPv6

If the send count is zero, then transmit_query() will return PJLIB_UTIL_EDNSNOWORKINGNS, however it does so without cancelling the timer, which then will be put back in the list of free timer entries.

    status = transmit_query(resolver, q);
    if (status != PJ_SUCCESS) {
                pj_list_push_back(&resolver->query_free_nodes, q);
                goto on_return;
    }

Thus, it could later result in timer heap corruption and crash after this uncancelled timer is reused and invalidated.

Thanks to Chris Tserng for the fix and Balamurugan Ramajeyam for the report.

Change History

comment:1 Changed 3 weeks ago by ming

  • Status changed from new to closed
  • Resolution set to fixed

In 5612:

Fixed #2024: Crash due to uncancelled timer if there's an error in resolver's query transmit

Note: See TracTickets for help on using tickets.