Opened 18 years ago
Last modified 18 years ago
#166 closed defect
libc: two serious __libc_tcpipops_Close4x bugs that might cause process crashes/hangs — at Initial Version
| Reported by: | bird | Owned by: | bird |
|---|---|---|---|
| Priority: | normal | Milestone: | libc-0.6.3 |
| Component: | libc-backend | Version: | 0.6.2 |
| Severity: | major | Keywords: | tcpip exitlist close |
| Cc: |
Description
The tcpip close method in tcpipver.cpp doesn't unlink the socket handle when it should, i.e. when the caller will be freeing it. This may cause corruption, crashes and exitlist hangs (with high cpu load).
When the socket is in use by another process and the close method only remove it from the tcpip32.dll exit list todos, it will set rc to 1 and think it failed. This typically happens when forking or spawning (libc) children. The result of this bug is that the socket which is really close, appears as not closed and we will be attempt closing it again (at exit if not earlier). It may also be incorrectly inherited by children which will confuse them. It may also break assumptions about dup()/open() results like in cupsd.
