Re: [Boost-bugs] [Boost C++ Libraries] #11097: test_scheduled_tp - ThreadSanitizer: heap-use-after-free

Subject: Re: [Boost-bugs] [Boost C++ Libraries] #11097: test_scheduled_tp - ThreadSanitizer: heap-use-after-free
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2016-09-03 18:40:56

#11097: test_scheduled_tp - ThreadSanitizer: heap-use-after-free
-------------------------------+----------------------
  Reporter:  viboes            |      Owner:  viboes
      Type:  Bugs              |     Status:  assigned
 Milestone:  To Be Determined  |  Component:  thread
   Version:  Boost 1.57.0      |   Severity:  Problem
Resolution:                    |   Keywords:
-------------------------------+----------------------

Comment (by viboes):

 I believe that I've found where the problem is. The call to
 super::data_.top().time


 {{{
         super::not_empty_.wait_until(lk, super::data_.top().time);
 }}}

 pass the time by reference while we need to copy it, as the storage can be
 re-arranged.

 {{{
   template <class T, class Clock>
   bool sync_timed_queue<T,
 Clock>::wait_until_not_empty_time_reached_or_closed(unique_lock<mutex>&
 lk)
   {
     for (;;)
     {
       if (super::closed(lk)) return true;
       while (! super::empty(lk)) {
         if (! time_not_reached(lk)) return false;
 -        super::not_empty_.wait_until(lk, super::data_.top().time);
 +        time_point tp = super::data_.top().time;
 +        super::not_empty_.wait_until(lk, tp);
         if (super::closed(lk)) return true;
       }
       if (super::closed(lk)) return true;
       super::not_empty_.wait(lk);
     }
     //return false;
   }

 }}}

 See this commit

 https://github.com/boostorg/thread/commit/c52a34c2cf1b2e9807a70065c03b0555895963df

-- 
Ticket URL: <https://svn.boost.org/trac/boost/ticket/11097#comment:10>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.