Details
Description
In plugin-libevent.c, event_new() mallocs a "struct event", which is not initialized, then passes it to event_assign(), which passes it into event_base_set(), causing an invalid read. We picked it up during a valgrind run of our program.
See lines 47 - 78 here: https://github.com/couchbase/libcouchbase/blob/master/plugins/io/libevent/plugin-libevent.c
Proposed patch:
Index: libcouchbase/src/plugin-libevent.c
===================================================================
--- libcouchbase/src/plugin-libevent.c (revision 16)
+++ libcouchbase/src/plugin-libevent.c (working copy)
@@ -47,7 +47,6 @@
event_callback_fn callback,
void *arg)
{
- event_base_set(base, ev);
ev->ev_callback = callback;
ev->ev_arg = arg;
ev->ev_fd = fd;
@@ -56,6 +55,7 @@
ev->ev_flags = EVLIST_INIT;
ev->ev_ncalls = 0;
ev->ev_pncalls = NULL;
+ event_base_set(base, ev);
return 0;
}
See lines 47 - 78 here: https://github.com/couchbase/libcouchbase/blob/master/plugins/io/libevent/plugin-libevent.c
Proposed patch:
Index: libcouchbase/src/plugin-libevent.c
===================================================================
--- libcouchbase/src/plugin-libevent.c (revision 16)
+++ libcouchbase/src/plugin-libevent.c (working copy)
@@ -47,7 +47,6 @@
event_callback_fn callback,
void *arg)
{
- event_base_set(base, ev);
ev->ev_callback = callback;
ev->ev_arg = arg;
ev->ev_fd = fd;
@@ -56,6 +55,7 @@
ev->ev_flags = EVLIST_INIT;
ev->ev_ncalls = 0;
ev->ev_pncalls = NULL;
+ event_base_set(base, ev);
return 0;
}