[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis

To: libevent-users@xxxxxxxxxxxxx
Subject: Re: [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis
From: Azat Khuzhin <a3at.mail@xxxxxxxxx>
Date: Thu, 12 Feb 2015 01:50:54 +0300
Cc: Shreyas Heranjal <shreyas@xxxxxxxxxxx>
Delivered-to: archiver@xxxxxxxx
Delivered-to: libevent-users-outgoing@xxxxxxxx
Delivered-to: libevent-users@xxxxxxxx
Delivery-date: Wed, 11 Feb 2015 17:51:01 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=wpprJ4hE/WvJjfISCMrz5+EJfMDPD3WKSCLK2Ew99eM=; b=RLvKUvBn1tHrClyQ8eBX5RbwAM8DL5kKcR/3gTu4bpdzrOXGu7aQk/F9CaQ8BmA2jj mBpqkF6CqHPd+BnO9EMy2rDOKO2VNXN5MSeBt+GvPL96eiDbO6zW7S664eniXZN2hezu oV/FOzEHmfBn5Ewj/fack3WwCuJwDBiyXNUjL4gcQ86ETuhrpk7v4LwwnP6r4xzHjFTs OFQbHZAmFBPNlCj0kP9QNzucB1rDPcyhhhFeyjH9jfkOtU9HfFst+dTLsPv1sNA0nZn2 gP8SRg6PgkEdZ44AvpYPLoBHJQY8/WrKjxVVundvdSrrUwfm1wN1sYEGemK78vTaXV0Y BgQg==
In-reply-to: <CAHwXwXTawWye_Dn3YQirNrHgQrZns6cythujVhcZPARV7HkoVg@xxxxxxxxxxxxxx>
References: <CAHwXwXQybUvXt1U9FE9GseiKBAq-Uf2i3d9rqi_QsUFk=ffPmw@xxxxxxxxxxxxxx> <20150203222300.GH31894@azat> <CAHwXwXTawWye_Dn3YQirNrHgQrZns6cythujVhcZPARV7HkoVg@xxxxxxxxxxxxxx>
Reply-to: libevent-users@xxxxxxxxxxxxx
Sender: owner-libevent-users@xxxxxxxxxxxxx
User-agent: Mutt/1.5.23 (2014-03-12)
On Wed, Feb 11, 2015 at 02:12:29PM -0800, Praveen Kariyanahalli wrote:
> Hi Azat
> 
> We upgraded our libevent to the latest code base
> https://github.com/libevent/libevent, We DO NOT see the crash anymore
> (Yay!!). This was very easily reproducible crash under stress, looks like
> you folks have fixed this in your latest code base.

I'm not the maintainer of the libevent, I'm just a developer who are
using it and patching.
(Basically avoid top-posting here - is a good idea).

> 
> Can you please point us to the exact patch which fixes this crash ? Or do
> you know if your next STABLE release will have a fix for this ? Please
> throw some light on as to how to proceed.

You could use $(git bisect) to see which patch fixes it, but you could
have some issues with bisect (some commits maybe not compilable).
But personally I can't use stable versions, because there are some
patches that necessary to me, but stable doesn't has them.
(That's why I do my own libevent packages)

Plus one comment below.

> 
> Thanks in Advance
> -Praveen
> 
> 
> On Tue, Feb 3, 2015 at 2:23 PM, Azat Khuzhin <a3at.mail@xxxxxxxxx> wrote:
> 
> > On Tue, Feb 03, 2015 at 01:39:22PM -0800, Praveen Kariyanahalli wrote:
> > > Client (bufferevent + openssl) crash *only under load situation*.
> > Valgrind
> > > points to this backtrace. Any help is greatly appreciated ? Please let us
> > > know if you need any more information.
> > >
> > > Thanks
> > > -Praveen
> > >
> > > Version: 2.0.22
> >
> > Hi Praveen,
> >
> > Could you try more recent version of libevent?
> > Preferably compile from sources using the latest code base at:
> > https://github.com/libevent/libevent
> >
> > >
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF66B: evmap_io_add (evmap.c:328)

Also recently I fixing one bug in deferred callbacks (some refcnt
issue) -- https://github.com/libevent/libevent/pull/208, and there was
invalid write (AFAIR -- it have similar invalid write in evmap_io_add())
*but* it was at some not-final debugging patch, IOW there was not
invalid write before that patches and after.
And which is more important -- *it is not merged into upstream yet*, so
it can't fix you issue.

BTW, did you check your program under valgrind drd/helgrind tool?
I think it is good idea to do this (I use it at some step of debugging
during writing that patchset).

> > > ==695==    by 0x52BC638: event_add_internal (event.c:2073)
> > > ==695==    by 0x52BC150: event_add (event.c:1966)
> > > ==695==    by 0x5504678: bufferevent_openssl_new_impl
> > > (bufferevent_openssl.c:1368)
> > > ==695==    by 0x550482B: bufferevent_openssl_socket_new
> > > (bufferevent_openssl.c:1440)
> > > ==695==    by 0x43211A: tls_connect_timer_cb (my_client_peer.c:528)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 232 bytes inside a block of size 608 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x52BE3F7: event_mm_free_ (event.c:2696)
> > > ==695==    by 0x52C878B: _bufferevent_decref_and_unlock
> > (bufferevent.c:650)
> >
> > Your program multithreaded?
> >
> > Could you strip you program to ~50-100L source, that will reproduce this
> > problem?
> >
> > Cheers,
> > Azat.
> >
> > > ==695==    by 0x52C8874: bufferevent_free (bufferevent.c:681)
> > > ==695==    by 0x435747: my_client_peer_delete (my_client_peer.c:1257)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x55034A0: consider_writing (bufferevent_openssl.c:881)
> > > ==695==    by 0x5503D41: be_openssl_outbuf_cb
> > (bufferevent_openssl.c:1119)
> > > ==695==    by 0x52C0B58: evbuffer_run_callbacks (buffer.c:486)
> > > ==695==    by 0x52C0C51: evbuffer_invoke_callbacks (buffer.c:508)
> > > ==695==    by 0x52C61AD: evbuffer_add_reference (buffer.c:2718)
> > > ==695==    by 0x41EF6E: my_client_pkt_send (my_client_msg.c:75)
> > > ==695==    by 0x445807: my_client_tunn_event_cb
> > (my_client_tun_intf.c:157)
> > > ==695==    by 0x52BA162: event_persist_closure (event.c:1301)
> > > ==695==    by 0x52BA271: event_process_active_single_queue (event.c:1345)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 232 bytes inside a block of size 608 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x52BE3F7: event_mm_free_ (event.c:2696)
> > > ==695==    by 0x52C878B: _bufferevent_decref_and_unlock
> > (bufferevent.c:650)
> > > ==695==    by 0x52C8874: bufferevent_free (bufferevent.c:681)
> > > ==695==    by 0x435747: my_client_peer_delete (my_client_peer.c:1257)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x550260C: stop_reading (bufferevent_openssl.c:422)
> > > ==695==    by 0x55028CE: conn_closed (bufferevent_openssl.c:528)
> > > ==695==    by 0x5502F56: do_write (bufferevent_openssl.c:694)
> > > ==695==    by 0x55033ED: consider_writing (bufferevent_openssl.c:874)
> > > ==695==    by 0x5503D41: be_openssl_outbuf_cb
> > (bufferevent_openssl.c:1119)
> > > ==695==    by 0x52C0B58: evbuffer_run_callbacks (buffer.c:486)
> > > ==695==    by 0x52C0C51: evbuffer_invoke_callbacks (buffer.c:508)
> > > ==695==    by 0x52C61AD: evbuffer_add_reference (buffer.c:2718)
> > > ==695==    by 0x41EF6E: my_client_pkt_send (my_client_msg.c:75)
> > > ==695==    by 0x445807: my_client_tunn_event_cb
> > (my_client_tun_intf.c:157)
> > > ==695==    by 0x52BA162: event_persist_closure (event.c:1301)
> > > ==695==    by 0x52BA271: event_process_active_single_queue (event.c:1345)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 232 bytes inside a block of size 608 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x52BE3F7: event_mm_free_ (event.c:2696)
> > > ==695==    by 0x52C878B: _bufferevent_decref_and_unlock
> > (bufferevent.c:650)
> > > ==695==    by 0x52C8874: bufferevent_free (bufferevent.c:681)
> > > ==695==    by 0x435747: my_client_peer_delete (my_client_peer.c:1257)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x5502659: stop_writing (bufferevent_openssl.c:435)
> > > ==695==    by 0x55028DA: conn_closed (bufferevent_openssl.c:529)
> > > ==695==    by 0x5502F56: do_write (bufferevent_openssl.c:694)
> > > ==695==    by 0x55033ED: consider_writing (bufferevent_openssl.c:874)
> > > ==695==    by 0x5503D41: be_openssl_outbuf_cb
> > (bufferevent_openssl.c:1119)
> > > ==695==    by 0x52C0B58: evbuffer_run_callbacks (buffer.c:486)
> > > ==695==    by 0x52C0C51: evbuffer_invoke_callbacks (buffer.c:508)
> > > ==695==    by 0x52C61AD: evbuffer_add_reference (buffer.c:2718)
> > > ==695==    by 0x41EF6E: my_client_pkt_send (my_client_msg.c:75)
> > > ==695==    by 0x445807: my_client_tunn_event_cb
> > (my_client_tun_intf.c:157)
> > > ==695==    by 0x52BA162: event_persist_closure (event.c:1301)
> > > ==695==    by 0x52BA271: event_process_active_single_queue (event.c:1345)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 232 bytes inside a block of size 608 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x52BE3F7: event_mm_free_ (event.c:2696)
> > > ==695==    by 0x52C878B: _bufferevent_decref_and_unlock
> > (bufferevent.c:650)
> > > ==695==    by 0x52C8874: bufferevent_free (bufferevent.c:681)
> > > ==695==    by 0x435747: my_client_peer_delete (my_client_peer.c:1257)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x5503FB5: be_openssl_destruct (bufferevent_openssl.c:1183)
> > > ==695==    by 0x52C85F5: _bufferevent_decref_and_unlock
> > (bufferevent.c:622)
> > > ==695==    by 0x52C8874: bufferevent_free (bufferevent.c:681)
> > > ==695==    by 0x435747: my_client_peer_delete (my_client_peer.c:1257)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 232 bytes inside a block of size 560 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x41EE2F: my_client_pktbuf_free (my_client_msg.c:54)
> > > ==695==    by 0x52BFFEC: evbuffer_chain_free (buffer.c:198)
> > > ==695==    by 0x52C251D: evbuffer_drain (buffer.c:972)
> > > ==695==    by 0x5502FA2: do_write (bufferevent_openssl.c:703)
> > > ==695==    by 0x55033ED: consider_writing (bufferevent_openssl.c:874)
> > > ==695==    by 0x5503D41: be_openssl_outbuf_cb
> > (bufferevent_openssl.c:1119)
> > > ==695==    by 0x52C0B58: evbuffer_run_callbacks (buffer.c:486)
> > > ==695==    by 0x52C0C51: evbuffer_invoke_callbacks (buffer.c:508)
> > > ==695==    by 0x52C61AD: evbuffer_add_reference (buffer.c:2718)
> > > ==695==    by 0x41EF6E: my_client_pkt_send (my_client_msg.c:75)
> > > ==695==    by 0x426213: my_client_generic_send_message
> > > (my_client_msg.c:1708)
> > > ==695==    by 0x4297B9: my_client_peer_send_hello (my_client_msg.c:2181)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF66B: evmap_io_add (evmap.c:328)
> > > ==695==    by 0x52BC638: event_add_internal (event.c:2073)
> > > ==695==    by 0x52BC150: event_add (event.c:1966)
> > > ==695==    by 0x52E695D: _evdns_nameserver_add_impl (evdns.c:2496)
> > > ==695==    by 0x52E6D7C: evdns_base_nameserver_ip_add (evdns.c:2592)
> > > ==695==    by 0x52E9B9B: resolv_conf_parse_line (evdns.c:3471)
> > > ==695==    by 0x52E9ECE: evdns_base_resolv_conf_parse_impl (evdns.c:3572)
> > > ==695==    by 0x52E9D60: evdns_base_resolv_conf_parse (evdns.c:3508)
> > > ==695==    by 0x52EA1A7: evdns_base_new (evdns.c:3881)
> > > ==695==    by 0x41AF33: my_client_connect_to_peer_my_clients
> > > (my_client.c:4978)
> > > ==695==    by 0x430FC6: my_client_peer_timer_exp_cb
> > (my_client_peer.c:285)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 1,480 bytes inside an unallocated block of
> > > size 2,960 in arena "client"
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x52EA318: evdns_nameserver_free (evdns.c:3930)
> > > ==695==    by 0x52EA4EB: evdns_base_free_and_unlock (evdns.c:3965)
> > > ==695==    by 0x52EA6DD: evdns_base_free (evdns.c:4001)
> > > ==695==    by 0x41A5AE: my_client_dns_getaddrinfo_cb (my_client.c:4778)
> > > ==695==    by 0x52EB9E9: evdns_getaddrinfo (evdns.c:4563)
> > > ==695==    by 0x41B02E: my_client_connect_to_peer_my_clients
> > > (my_client.c:5000)
> > > ==695==    by 0x430FC6: my_client_peer_timer_exp_cb
> > (my_client_peer.c:285)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 1,480 bytes inside an unallocated block of
> > > size 2,960 in arena "client"
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF66B: evmap_io_add (evmap.c:328)
> > > ==695==    by 0x52BC638: event_add_internal (event.c:2073)
> > > ==695==    by 0x52BC150: event_add (event.c:1966)
> > > ==695==    by 0x431580: ssl_connect_timer_cb (my_client_peer.c:371)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 1,480 bytes inside an unallocated block of
> > > size 2,960 in arena "client"
> > > ==695==
> > > ==695== Invalid write of size 8
> > > ==695==    at 0x52CF8DD: evmap_io_del (evmap.c:384)
> > > ==695==    by 0x52BCE7B: event_del_internal (event.c:2251)
> > > ==695==    by 0x52BCBD7: event_del (event.c:2188)
> > > ==695==    by 0x52BB484: event_free (event.c:1809)
> > > ==695==    by 0x435B36: my_client_peer_delete (my_client_peer.c:1323)
> > > ==695==    by 0x430EE8: my_client_peer_timer_exp_cb
> > (my_client_peer.c:267)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==    by 0x41E5BA: main (my_client.c:6024)
> > > ==695==  Address 0x86ff848 is 8 bytes inside a block of size 160 free'd
> > > ==695==    at 0x4A0739B: free (vg_replace_malloc.c:473)
> > > ==695==    by 0x48B3EB: vip_guard_mem_free (vip_gaurd_mem.c:157)
> > > ==695==    by 0x5BFD5F9: CRYPTO_free (mem.c:401)
> > > ==695==    by 0x5CA9915: EVP_MD_CTX_cleanup (digest.c:390)
> > > ==695==    by 0x5CA532E: ssleay_rand_bytes (md_rand.c:525)
> > > ==695==    by 0x5CA53DB: ssleay_rand_pseudo_bytes (md_rand.c:548)
> > > ==695==    by 0x5CA5C67: RAND_pseudo_bytes (rand_lib.c:173)
> > > ==695==    by 0x594394A: ssl_fill_hello_random (s23_clnt.c:294)
> > > ==695==    by 0x5951112: dtls1_client_hello (d1_clnt.c:801)
> > > ==695==    by 0x59505CB: dtls1_connect (d1_clnt.c:302)
> > > ==695==    by 0x595C8E0: SSL_connect (ssl_lib.c:943)
> > > ==695==    by 0x441DBC: create_ssl_conn_to_peer (my_client_misc.c:2134)
> > > ==695==    by 0x4346AB: my_client_peer_create (my_client_peer.c:1018)
> > > ==695==    by 0x41B1BB: my_client_connect_to_peer_my_clients
> > > (my_client.c:5022)
> > > ==695==    by 0x41ABF9: my_client_dns_getaddrinfo_cb (my_client.c:4886)
> > > ==695==    by 0x52EB9E9: evdns_getaddrinfo (evdns.c:4563)
> > > ==695==    by 0x41B02E: my_client_connect_to_peer_my_clients
> > > (my_client.c:5000)
> > > ==695==    by 0x430FC6: my_client_peer_timer_exp_cb
> > (my_client_peer.c:285)
> > > ==695==    by 0x488AC6: timer_exec_pri (timer.c:612)
> > > ==695==    by 0x4885A1: timer_exec (timer.c:504)
> > > ==695==    by 0x41A165: my_client_base_timer_cb (my_client.c:4671)
> > > ==695==    by 0x52BA2CC: event_process_active_single_queue (event.c:1350)
> > > ==695==    by 0x52BA540: event_process_active (event.c:1420)
> > > ==695==    by 0x52BABA7: event_base_loop (event.c:1621)
> > > ==695==    by 0x41C5D9: my_client_main (my_client.c:5437)
> > > ==695==
> > >
> > > valgrind:
> > >
> > /jenkins/master/builder/x86_64/tmp/work/x86_64-poky-linux/valgrind/3.10.0-r15/valgrind-3.10.0/coregrind/m_mallocfree.c:304
> > > (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
> > > valgrind: Heap block lo/hi size mismatch: lo = 224, hi = 0.
> > ***********************************************************************
> > To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with
> > unsubscribe libevent-users    in the body.
> >
> 
> 
> 
> -- 
> 
> Regards
> -Praveen

-- 
Respectfully
Azat Khuzhin
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with
unsubscribe libevent-users    in the body.
References:
- [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis
  - From: Praveen Kariyanahalli
- Re: [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis
  - From: Azat Khuzhin
- Re: [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis
  - From: Praveen Kariyanahalli
Prev by Author: Re: [Libevent-users] Re: undefined reference to event_base_add_virtual in libevent 2.1
Next by Author: Re: [Libevent-users] deadlock in callbacks
Previous by thread: Re: [Libevent-users] Memory (heap meta-data) corruption while using buffervent_openssl apis
Next by thread: Re: [Libevent-users] requests over HTTPS after server-side close
Index(es):
- Author
- Thread