lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(libxce): bug-1600 -- makeGroup() freed rtti makeString() pointer via raw free()

Browse source 
makeGroup()'s existing-group update path (hit whenever a config-push
re-applies a group name that already has members, e.g. a retried config
push during controller failover) released xce_g_member_t.u.name via
FREEUP() (plain free()). u.name is allocated by makeString(), an
rtti-managed, refcounted pointer that is not a malloc()-base address --
freeing it directly corrupts the heap. group_killer() in the same file
already releases the identical field correctly via dereference().

Switch both FREEUP(m->u.name) call sites to dereference(m->u.name) to
match. Add a regression test that re-applies config for the same group
name twice, reproducing the exact ASAN bad-free at group.c:234 pre-fix.

This is the root cause of the reproducible xce_scheduler
"free(): invalid pointer" SIGABRT crashes seen during 3-attempt
controller-failover config-push retries (8 confirmed core dumps).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-08-20 04:06:05 +00:00
parent 6522a73459
commit ddee884c1b
No known key found for this signature in database
GPG key ID: 5BCDAAE0123E9FE2
4 changed files with 62 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/lib/group.c
View file

@ -231,7 +231,7 @@ xce_group_t* makeGroup(var mgr, xce_group_config_t* config,
continue;
}
if (m->is_group == 0) {
FREEUP(m->u.name);
dereference(m->u.name);
}
FREEUP(m);
@ -244,7 +244,7 @@ xce_group_t* makeGroup(var mgr, xce_group_config_t* config,
continue;
}
if (m->is_group == 0) {
FREEUP(m->u.name);
dereference(m->u.name);
}
FREEUP(m);