Project

General

Profile

Actions

Bug #2865

closed

Possible false remove in Face::cancelPendingInterest (address used as handle)

Added by Anonymous almost 9 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Base
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
3.00 h

Description

expressInterest returns the memory address of the interest copy as the PendingInterestId.

And removePendingInterest uses this memory address to find the entry to remove it from the PIT.

Note that removePendingInterest is supposed to do nothing if the interest is no longer in the PIT.

Therefore, the following failure mode is possible:

  1. The application calls expressInterest for interest 1 and receives memory address X of the interest copy as the PendingInterestId.
  2. The application keeps X.
  3. A data packet is received, the library removes interest 1 from the PIT, freeing the memory of the interest.
  4. The application calls expressInterest again for interest 2. (This returned PendingInterestId is ignored.) The library just happens to use the same memory address X for the interest copy.
  5. Another part of the application wants to cancel the original interest 1, and calls removePendingInterest(X).
  6. Interest 1 is no longer in the PIT. But the memory address X is re-used as the same PendingInterestId for interest 2, so the library falsely removes interest 2 from the PIT.
Actions

Also available in: Atom PDF