[Libevent-users] RPC: Problem with hooks and evrpc_reply_done_closure ?

[Christophe Fillot <cf@xxxxxx>]

Hello all,

I'm using libevent-2.0.10, and I think I discovered a problem when the
following conditions are met:

- A hook returning EVRPC_PAUSE is set in the input direction ;
- The RPC fails due to an HTTP problem ("connection refused" for example)

In evrpc.c, evrpc_reply_done() is set as a callback for the HTTP request.
When this callback is run, it scans for the input hooks, and if a hook
returns EVRPC_PAUSE, the HTTP request is marked as owned by the caller
with evhttp_request_own(). It is manually freed later by
evrpc_reply_done_closure() when evrpc_resume_request() is called. In fact,
the evhttp code frees the HTTP request if it is not marked as owned in
evhttp_connection_done().

However, in case of error, evhttp_connection_fail() is called, and frees
the HTTP request without checking the owner flag.
The problem occurs when evrpc_resume_request() is called: it calls
evrpc_reply_done_closure() which assumes the HTTP request is still valid.

Best regards,

Christophe

***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with
unsubscribe libevent-users    in the body.