Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-30648

SSL Heap modify after free

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P3: Somewhat important
    • 5.1.1
    • 5.1.0
    • Network: SSL
    • None
    • Qt 5.1 Alpha 1. Windows 7. MSVC-2010 Win32
    • 835e720c7e47e3e5ea70875bf26b0b71d6729b57

    Description

      This bug affects 5.1 Alpha (this selection is not available in drop-down)

      When using a QNetworkAccessManager to do a HTTP request over SSL the app will crash on exit due to double freeing of a SSL Context resource.

      Debug output:
      Debugging starts
      QSslSocket: cannot resolve TLSv1_1_client_method
      QSslSocket: cannot resolve TLSv1_2_client_method
      QSslSocket: cannot resolve TLSv1_1_server_method
      QSslSocket: cannot resolve TLSv1_2_server_method
      HEAP[crashtest.exe]: HEAP: Free Heap block 2142c80 modified at 2142f1c after it was freed
      Debugging has finished

      Stack trace:

      0 QAtomicOpsBySize<4>::deref qatomic_msvc.h 309 0x5685cc09
      1 QBasicAtomicInteger<int>::deref qbasicatomic.h 153 0x5685cbf0
      2 QSharedDataPointer<QSslConfigurationPrivate>::~QSharedDataPointer<QSslConfigurationPrivate> qshareddata.h 87 0x569250cb
      3 QSslConfiguration::~QSslConfiguration qsslconfiguration.cpp 141 0x5692432f
      4 QSslContext::~QSslContext qsslcontext.cpp 75 0x56940788
      5 QSslContext::`scalar deleting destructor' Qt5Networkd 0x56936e6f
      6 QtSharedPointer::CustomDeleter<QSslContext,QtSharedPointer::NormalDeleter>::execute qsharedpointer_impl.h 196 0x56936e37
      7 QtSharedPointer::ExternalRefCountWithCustomDeleter<QSslContext,QtSharedPointer::NormalDeleter>::deleter qsharedpointer_impl.h 218 0x56936ce5
      8 QtSharedPointer::ExternalRefCountData::destroy qsharedpointer_impl.h 158 0x5686d9a3
      9 QSharedPointer<QSslContext>::deref qsharedpointer_impl.h 451 0x5686da78
      10 QSharedPointer<QSslContext>::deref qsharedpointer_impl.h 444 0x5686d813
      11 QSharedPointer<QSslContext>::~QSharedPointer<QSslContext> qsharedpointer_impl.h 312 0x5686d52f
      12 QHttpNetworkConnectionPrivate::~QHttpNetworkConnectionPrivate qhttpnetworkconnection.cpp 114 0x56867180
      13 QHttpNetworkConnectionPrivate::`scalar deleting destructor' Qt5Networkd 0x5686cfef
      14 QScopedPointerDeleter<QObjectData>::cleanup qscopedpointer.h 62 0x5826a1f6
      15 QScopedPointer<QObjectData,QScopedPointerDeleter<QObjectData> >::~QScopedPointer<QObjectData,QScopedPointerDeleter<QObjectData> > qscopedpointer.h 98 0x58269c2a
      16 QObject::~QObject qobject.cpp 863 0x5825e7eb
      17 QHttpNetworkConnection::~QHttpNetworkConnection qhttpnetworkconnection.cpp 1148 0x5686b4f9
      18 QNetworkAccessCachedHttpConnection::~QNetworkAccessCachedHttpConnection Qt5Networkd 0x568b649a
      19 QNetworkAccessCachedHttpConnection::`scalar deleting destructor' Qt5Networkd 0x568b644f
      20 QNetworkAccessCachedHttpConnection::dispose qhttpthreaddelegate.cpp 170 0x568b641d
      21 QNetworkAccessCache::clear qnetworkaccesscache.cpp 127 0x56881e47
      22 QNetworkAccessCache::~QNetworkAccessCache qnetworkaccesscache.cpp 114 0x56881d98
      23 QNetworkAccessCache::`scalar deleting destructor' Qt5Networkd 0x56882d5f
      24 qThreadStorage_deleteData<QNetworkAccessCache> qthreadstorage.h 94 0x568b6a77
      25 QThreadStorage<QNetworkAccessCache *>::deleteData qthreadstorage.h 137 0x568b6a3e
      26 QThreadStorageData::finish qthreadstorage.cpp 203 0x57fb6e40
      27 QThreadPrivate::finish qthread_win.cpp 365 0x57fb9fef
      28 QThreadPrivate::start qthread_win.cpp 349 0x57fb9f10
      29 _beginthreadex MSVCR100D 0x586ca273
      30 _beginthreadex MSVCR100D 0x586ca204
      31 BaseThreadInitThunk kernel32 0x74ac33aa
      32 __RtlUserThreadStart ntdll32 0x77289ef2
      33 _RtlUserThreadStart ntdll32 0x77289ec5

      Attached small example project. This error can be trapped by using gflags.exe -p /enable crashtest.exe /full

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            peter-har Peter Hartmann
            altera_2011 ron
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes