[boost] [asio]ssl::detail::stream_core is accessed after destruction

Subject: [boost] [asio]ssl::detail::stream_core is accessed after destruction
From: Takatoshi Kondo (redboltz_at_[hidden])
Date: 2017-03-26 11:02:05

Hello,

I'm using Boost.Asio. I compiled some TLS client with clang address sanitizer.
(I attached the result the last part of this mail.)

It indicates that the following `expires_at` member function calling is bad:
https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/detail/io.hpp#L257

So I insert debug print "stream_core() address" to the constructor of
ssl::detail::stream_core
https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/detail/stream_core.hpp#L54

"~stream_core() address" to the destructor,
https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/detail/stream_core.hpp#L60

and "io stream_core address of core_" to `expires_at` calling point:
https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/detail/io.hpp#L257

And then, I got the following result:

stream_core() 0x6120012beb60           constructor
~stream_core() 0x6120012ca6e0
connected. previous session = false
stream_core() 0x6120012ba060
~stream_core() 0x6120012beb60          destructor
io stream_core 0x6120012beb60          call

Is seems that `expires_at` at
https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/detail/io.hpp#L257
is called after core_ 's destructor is called.

The problem happens a part of big project. The client connects to the
server as TLS-stream, then server shutdown the stream, then client
connects again. The program does the sequence repeatedly. The error
happens the client side.

I'm trying to write a minimal and complete code that reproduces the
problem, but not yet. So I report the result only as the first report.

The result of clang address sanitizer
----------------------------------------------------------------------------------

SUMMARY: AddressSanitizer: heap-use-after-free
/usr/include/boost/asio/basic_deadline_timer.hpp:344:27 in
boost::asio::basic_deadline_timer<boost::posix_time::ptime,
boost::asio::time_traits<boost::posix_time::ptime>,
boost::asio::deadline_timer_service<boost::posix_time::ptime,
boost::asio::time_traits<boost::posix_time::ptime> >
>::expires_at(boost::posix_time::ptime const&)
Shadow bytes around the buggy address:
  0x0c248024fd20: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x0c248024fd30: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c248024fd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c248024fd50: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x0c248024fd60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c248024fd70: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
  0x0c248024fd80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c248024fd90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c248024fda0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c248024fdb0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c248024fdc0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11437==ABORTING

----------------------------------------------------------------------------------

heap use after free occurs the following code:

----------------------------------------------------------------------------------

==11437==ERROR: AddressSanitizer: heap-use-after-free on address
0x6120012bebb0 at pc 0x000000749b30 bp 0x7ffccc310470 sp
0x7ffccc310468
READ of size 8 at 0x6120012bebb0 thread T0
    #0 0x749b2f in
boost::asio::basic_deadline_timer<boost::posix_time::ptime,
boost::asio::time_traits<boost::posix_time::ptime>,
boost::asio::deadline_timer_service<boost::posix_time::ptime,
boost::asio::time_traits<boost::posix_time::ptime> >
>::expires_at(boost::posix_time::ptime const&)
/usr/include/boost/asio/basic_deadline_timer.hpp:344:27
    #1 0x748e21 in
boost::asio::ssl::detail::io_op<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> >,
boost::asio::ssl::detail::write_op<boost::asio::mutable_buffers_1>,
boost::asio::detail::write_op<boost::asio::ssl::stream<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> > >,
boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t,
boost::asio::detail::wrapped_handler<boost::asio::io_service::strand,
mqtt::endpoint<boost::asio::ssl::stream<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> > >,
boost::asio::io_service::strand, std::mutex,
std::lock_guard>::write_completion_handler,
boost::asio::detail::is_continuation_if_running> >
>::operator()(boost::system::error_code, unsigned long, int)
/usr/include/boost/asio/ssl/detail/io.hpp:260:32
    #2 0x7590e7 in
boost::asio::detail::write_op<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> >,
boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t,
boost::asio::ssl::detail::io_op<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp>
>,boost::asio::ssl::detail::write_op<boost::asio::mutable_buffers_1>,
boost::asio::detail::write_op<boost::asio::ssl::stream<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> > >,
boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t,
boost::asio::detail::wrapped_handler<boost::asio::io_service::strand,
mqtt::endpoint<boost::asio::ssl::stream<boost::asio::basic_stream_socket<boost::asio::ip::tcp,
boost::asio::stream_socket_service<boost::asio::ip::tcp> > >,
boost::asio::io_service::strand, std::mutex,
std::lock_guard>::write_completion_handler,
boost::asio::detail::is_continuation_if_running> > >
>::operator()(boost::system::error_code const&, unsigned long, int)
/usr/include/boost/asio/impl/write.hpp:269:9

Thanks,
Takatoshi Kondo