Details
Description
In plugin-libevent.c, event_new() mallocs a "struct event", which is not initialized, then passes it to event_assign(), which passes it into event_base_set(), causing an invalid read. We picked it up during a valgrind run of our program.
See lines 47 - 78 here: https://github.com/couchbase/libcouchbase/blob/master/plugins/io/libevent/plugin-libevent.c
Proposed patch:
Index: libcouchbase/src/plugin-libevent.c
===================================================================
--- libcouchbase/src/plugin-libevent.c (revision 16)
+++ libcouchbase/src/plugin-libevent.c (working copy)
@@ -47,7 +47,6 @@
event_callback_fn callback,
void *arg)
{
- event_base_set(base, ev);
ev->ev_callback = callback;
ev->ev_arg = arg;
ev->ev_fd = fd;
@@ -56,6 +55,7 @@
ev->ev_flags = EVLIST_INIT;
ev->ev_ncalls = 0;
ev->ev_pncalls = NULL;
+ event_base_set(base, ev);
return 0;
}
See lines 47 - 78 here: https://github.com/couchbase/libcouchbase/blob/master/plugins/io/libevent/plugin-libevent.c
Proposed patch:
Index: libcouchbase/src/plugin-libevent.c
===================================================================
--- libcouchbase/src/plugin-libevent.c (revision 16)
+++ libcouchbase/src/plugin-libevent.c (working copy)
@@ -47,7 +47,6 @@
event_callback_fn callback,
void *arg)
{
- event_base_set(base, ev);
ev->ev_callback = callback;
ev->ev_arg = arg;
ev->ev_fd = fd;
@@ -56,6 +55,7 @@
ev->ev_flags = EVLIST_INIT;
ev->ev_ncalls = 0;
ev->ev_pncalls = NULL;
+ event_base_set(base, ev);
return 0;
}
Activity
Sergey Avseyev
made changes -
| Field | Original Value | New Value |
|---|---|---|
| Fix Version/s | 2.0.3 [ 10470 ] |
Sergey Avseyev
made changes -
| Status | Open [ 1 ] | Resolved [ 5 ] |
| Resolution | Fixed [ 1 ] |
Sergey Avseyev
made changes -
| Status | Resolved [ 5 ] | Closed [ 6 ] |