Ticket #769 (closed defect: fixed)

Opened 10 years ago

Last modified 10 years ago

Bug in select ioqueue: event counter may exceed maximum value, causing stack corruption (thanks Joel Dodson for the report)

Reported by: bennylp Owned by: bennylp
Priority: normal Milestone: release-1.2
Component: pjlib Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported:

Description (last modified by bennylp) (diff)

Stack corruption in pj_ioqueue_poll(), when execution is about to return:

#if PJ_IOQUEUE_HAS_SAFE_UNREG

      decrement_counter(event[counter].key);

#endif
    }
    return count;

count and counter are 17. Unfortunately, event is only 16 elements long.

The corresponding ticket for 1.0 branch is ticket #770

Change History

comment:1 Changed 10 years ago by bennylp

  • Description modified (diff)

comment:2 Changed 10 years ago by bennylp

  • Status changed from new to closed
  • Resolution set to fixed

In r2554:

  • fixed
Note: See TracTickets for help on using tickets.