Skip to content

fix use after free when using botan

WARNING: ThreadSanitizer: heap-use-after-free (pid=73943)
  Atomic write of size 4 at 0x7b0800000e68 by main thread:
    #0 boost::detail::atomic_decrement(unsigned int*) /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:40 (libkea-cryptolink.so.48+0x8a2c)
    #1 boost::detail::sp_counted_base::release() /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:118 (libkea-cryptolink.so.48+0x8a2c)
    #2 boost::detail::shared_count::~shared_count() /usr/include/boost/smart_ptr/detail/shared_count.hpp:432 (libkea-cryptolink.so.48+0x8a2c)
    #3 boost::shared_ptr<isc::cryptolink::RNG>::~shared_ptr() /usr/include/boost/smart_ptr/shared_ptr.hpp:335 (libkea-cryptolink.so.48+0x8a2c)
    #4 boost::shared_ptr<isc::cryptolink::RNG>::reset() /usr/include/boost/smart_ptr/shared_ptr.hpp:687 (libkea-cryptolink.so.48+0x8a2c)
    #5 operator() /home/razvan/isc/git/kea-work/src/lib/cryptolink/botan_link.cc:74 (libkea-cryptolink.so.48+0x8a2c)
    #6 _FUN /home/razvan/isc/git/kea-work/src/lib/cryptolink/botan_link.cc:74 (libkea-cryptolink.so.48+0x8a2c)
    #7 cxa_at_exit_wrapper ../../../../src/libsanitizer/tsan/tsan_interceptors_posix.cpp:389 (libtsan.so.2+0x2e813)

  Previous write of size 8 at 0x7b0800000e68 by main thread:
    #0 operator delete(void*, unsigned long) ../../../../src/libsanitizer/tsan/tsan_new_delete.cpp:150 (libtsan.so.2+0x8cef5)
    #1 boost::detail::sp_counted_impl_p<isc::cryptolink::RNGImpl>::~sp_counted_impl_p() /usr/include/boost/smart_ptr/detail/sp_counted_impl.hpp:64 (libkea-cryptolink.so.48+0x914e)
    #2 boost::detail::sp_counted_base::destroy() /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:99 (libkea-cryptolink.so.48+0x8c27)
    #3 boost::detail::sp_counted_base::weak_release() /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:134 (libkea-cryptolink.so.48+0x8c27)
    #4 boost::detail::sp_counted_base::release() /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:121 (libkea-cryptolink.so.48+0x8c27)
    #5 boost::detail::shared_count::~shared_count() /usr/include/boost/smart_ptr/detail/shared_count.hpp:432 (libkea-cryptolink.so.48+0x8c27)
    #6 boost::shared_ptr<isc::cryptolink::RNG>::~shared_ptr() /usr/include/boost/smart_ptr/shared_ptr.hpp:335 (libkea-cryptolink.so.48+0x8c27)
    #7 isc::cryptolink::CryptoLink::~CryptoLink() /home/razvan/isc/git/kea-work/src/lib/cryptolink/botan_link.cc:27 (libkea-cryptolink.so.48+0x8c27)
    #8 cxa_at_exit_wrapper ../../../../src/libsanitizer/tsan/tsan_interceptors_posix.cpp:389 (libtsan.so.2+0x2e813)

SUMMARY: ThreadSanitizer: heap-use-after-free /usr/include/boost/smart_ptr/detail/sp_counted_base_gcc_atomic.hpp:40 in boost::detail::atomic_decrement(unsigned int*)
==================
ThreadSanitizer: reported 1 warnings
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information