Skip to content
This repository has been archived by the owner on Apr 12, 2024. It is now read-only.

Commit

Permalink
fix: Guard against double-free of galacticChannel objects (#71)
Browse files Browse the repository at this point in the history
Signed-off-by: Josh Kim <[email protected]>
  • Loading branch information
jooskim authored May 6, 2022
1 parent 899da9a commit 879d738
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 2 deletions.
10 changes: 10 additions & 0 deletions build/npm/transport.json
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,16 @@
],
"license": "BSD-2-Clause",
"changelogHistory": [
{
"date": "5/6/22",
"version": "1.3.6",
"notes": [
{
"description": "Guard against race condition from process sleep/wake that corrupt galacticChannels map state",
"review_uri": "https://github.com/vmware/transport-typescript/pull/61"
}
]
},
{
"date": "9/8/21",
"version": "1.3.5",
Expand Down
11 changes: 10 additions & 1 deletion src/bridge/broker-connector.ts
Original file line number Diff line number Diff line change
Expand Up @@ -690,7 +690,16 @@ export class BrokerConnector implements EventBusEnabled {
const session = this.sessions.get(sessionId);
for (let [chan, bIds] of this.channelBrokerIdentitiesMap.entries()) {
// decrement connectedBrokers for the channel
this._galacticChannels.get(chan).connectedBrokers--;
// NOTE: in an unlikely scenario, there could be a "double free" condition of the galactic channel object
// that had been already cleaned up by this.closeGalacticChannel() when an event from the _closeObservable
// tried to access the object and decrement the connectedBrokers counter, leading to access to undefined.
// this is an extremely hard to reproduce issue, but I suspect that it greatly has to do with the browser
// tab process being put to sleep (after a long idle) and a resultant race condition that may have led to
// the above chain of actions. a fix implemented here is to protect the decrement instruction against
// a situation where the galactic channel object has been destroyed.
if (this._galacticChannels.has(chan)) {
this._galacticChannels.get(chan).connectedBrokers--;
}

// If the client will not immediately try to reconnect, clean up by
// removing the connection string from the channelBrokerIdentitiesMap
Expand Down
2 changes: 1 addition & 1 deletion src/bus.api.ts
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ import { BrokerConnector } from './bridge';
export declare type NgZoneRef = any;

// current version
const version = '1.3.5';
const version = '1.3.6';

export type ChannelName = string;
export type SentFrom = string;
Expand Down

0 comments on commit 879d738

Please sign in to comment.