Fix for double-free (and possibly other memory-corruption related) crashes at logrota...

this is a direct fix of the issue revealing the problem that leads to crash

verification done with a patched icinga2 where the execution-order of the code lines of counter-parts involved in re-incrementing/decrementing Timer:Ptr is forced to be the one that leads to the obeserverd segfaults

refs #6737

diff --git a/lib/base/timer.cpp b/lib/base/timer.cpp
index 65a5d688b5c9cb597f5eaee0540ff8952dc39daa..ff00e79aa0c492d73b9f3eb6455118806e9e6e56 100644 (file)
--- a/lib/base/timer.cpp
+++ b/lib/base/timer.cpp
@@ -110,7 +110,7 @@ void Timer::UninitializeThread()
 void Timer::Call()
 {
        try {
-               OnTimerExpired(Timer::Ptr(this));
+               OnTimerExpired(this);
        } catch (...) {
                InternalReschedule(true);
 
@@ -301,8 +301,6 @@ void Timer::TimerThreadProc()
                        continue;
                }
 
-               Timer::Ptr ptimer = timer;
-
                /* Remove the timer from the list so it doesn't get called again
                 * until the current call is completed. */
                l_Timers.erase(timer);
@@ -312,6 +310,6 @@ void Timer::TimerThreadProc()
                lock.unlock();
 
                /* Asynchronously call the timer. */
-               Utility::QueueAsyncCallback(std::bind(&Timer::Call, ptimer));
+               Utility::QueueAsyncCallback(std::bind(&Timer::Call, timer));
        }
 }

diff --git a/lib/base/timer.hpp b/lib/base/timer.hpp
index 24937b7d52d77aed9cdea6d6d9eaed84a776fb75..2088a66607ced9ecc4f5d7c950021154a15c029d 100644 (file)
--- a/lib/base/timer.hpp
+++ b/lib/base/timer.hpp
@@ -39,7 +39,7 @@ public:
        void Reschedule(double next = -1);
        double GetNext() const;
 
-       boost::signals2::signal<void(const Timer::Ptr&)> OnTimerExpired;
+       boost::signals2::signal<void(const Timer * const&)> OnTimerExpired;
 
 private:
        double m_Interval{0}; /**< The interval of the timer. */

diff --git a/test/base-timer.cpp b/test/base-timer.cpp
index db6922ebc46b56d2ca5f4a180bcaf2c692aea85e..d3a4a0040ac35c483196cd47520346ec4d74234c 100644 (file)
--- a/test/base-timer.cpp
+++ b/test/base-timer.cpp
@@ -24,7 +24,7 @@ BOOST_AUTO_TEST_CASE(interval)
 
 int counter = 0;
 
-static void Callback(const Timer::Ptr&)
+static void Callback(const Timer * const&)
 {
        counter++;
 }