ellzey/libevhtp — Issue #21: still tries to access the evhtp_connection_s struct once freed
Author: key2
Created: 2011-12-16 23:09:07+00:00
State: open

bug:
when the evhtp_connection_free(con); is called in the callback, when returning from the callback, it still tries to reach the structure in htparse. Needs to detect that it got freed

==1807== at 0x40E401: htparser_run (htparse.c:1601)
==1807== by 0x40A616: _evhtp_connection_readcb (evhtp.c:1168)
==1807== by 0x4E48D2D: bufferevent_run_deferred_callbacks_locked (bufferevent.c:148)
==1807== by 0x4E3F72A: event_base_loop (event.c:1364)
==1807== by 0x40632C: main (bayeux.c:645)
==1807== Address 0x6c449c4 is 4 bytes inside a block of size 8,304 free'd
==1807== at 0x4C282ED: free (vg_replace_malloc.c:366)
==1807== by 0x40A2DE: evhtp_connection_free (evhtp.c:2451)
==1807== by 0x404516: dump_request_cb (mytest.c:433)
==1807== by 0x406A5B: _evhtp_request_parser_fini (evhtp.c:1057)
==1807== by 0x40E400: htparser_run (htparse.c:241)
==1807== by 0x40A616: _evhtp_connection_readcb (evhtp.c:1168)
==1807== by 0x4E48D2D: bufferevent_run_deferred_callbacks_locked (bufferevent.c:148)
==1807== by 0x4E3F72A: event_base_loop (event.c:1364)
==1807== by 0x40632C: main (mytest.c:645)

trigger:

static void dump_request_cb(evhtp_request_t *req, void *arg)
struct bufferevent *bev;
evhtp_connection_t * con;
con = evhtp_request_get_connection(req);
bev = evhtp_request_get_bev(req);
evhtp_request_set_bev(req, NULL);
evhtp_connection_free(con);

return EVHTP_RES_OK;
}

int main()
{
...
evhtp_set_gencb(htp, dump_request_cb, NULL);
...
}