cocaine/cocaine-dealer — pull request #4 by bogdad (2012-10-22 13:08:48+00:00)
Title: dealer_impl: storage_iteration_callback, msgpack mem corruption

Hi!

When calling dealer->get_stored_messages(...),
the sometimes the following error occurs:

*** glibc detected *** ./dealer_test_app: double free or corruption (!prev): 0x00007ff7a40de2c0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7e626)[0x7ff7c7bb2626]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN7msgpack8unpackerD1Ev+0x18)[0x7ff7c886234c]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN7cocaine6dealer13dealer_impl_t26storage_iteration_callbackERKSsPvmi+0x381)[0x7ff7c8861969]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZNK5boost4_mfi3mf4IvN7cocaine6dealer13dealer_impl_tERKSsPvmiEclEPS4_S6_S7_mi+0x78)[0x7ff7c887a976]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN5boost3_bi5list5INS0_5valueIPN7cocaine6dealer13dealer_impl_tEEENS_3argILi1EEENS8_ILi2EEENS8_ILi3EEENS8_ILi4EEEEclINS_4_mfi3mf4IvS5_RKSsPvmiEENS0_5list4ISI_RSJ_RmRiEEEEvNS0_4typeIvEERT_RT0_i+0xc2)[0x7ff7c8876c8c]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN5boost3_bi6bind_tIvNS_4_mfi3mf4IvN7cocaine6dealer13dealer_impl_tERKSsPvmiEENS0_5list5INS0_5valueIPS6_EENS_3argILi1EEENSF_ILi2EEENSF_ILi3EEENSF_ILi4EEEEEEclIS7_S9_miEEvRT_RT0_RT1_RT2_+0x5c)[0x7ff7c887392c]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN5boost6detail8function26void_function_obj_invoker4INS_3_bi6bind_tIvNS_4_mfi3mf4IvN7cocaine6dealer13dealer_impl_tERKSsPvmiEENS3_5list5INS3_5valueIPS9_EENS_3argILi1EEENSI_ILi2EEENSI_ILi3EEENSI_ILi4EEEEEEEvSB_SC_miE6invokeERNS1_15function_bufferESB_SC_mi+0x43)[0x7ff7c8870525]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZNK5boost9function4IvRKSsPvmiEclES2_S3_mi+0x75)[0x7ff7c8852a03]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN7cocaine6dealer7eblob_t27iteration_callback_instanceERKSsPvmi+0x7a)[0x7ff7c8851b8c]
/home/vshakhov/bogdad/cocaine-dealer/libcocaine-dealer.so.1(_ZN7cocaine6dealer7eblob_t18iteration_callbackEP18eblob_disk_controlP17eblob_ram_controlPvS6_S6_+0x78)[0x7ff7c8851ac0]
/usr/local/lib/libeblob.so.0(+0x39aa)[0x7ff7c6a379aa]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7e9a)[0x7ff7c791ee9a]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7ff7c7c264bd]

This is due to

msgpack::unpacker pac(size); uses first COUNTER_SIZE bytes for storing its internal counter, (at dealer_impl.cpp::storage_iteration_callback)
and only (size - COUNTER_SIZE) bytes of buffer are available for writing to.
and memcpy(pac.buffer(), data, size); at dealer_impl.cpp: line 371 writes to unallocated memory.

fix included:
when using
pac.reserve_buffer(size); - correct buffer size is allocated