cyclonedds icon indicating copy to clipboard operation
cyclonedds copied to clipboard

Crash in typebuilder_type_fini() at src\core\ddsi\src\ddsi_typebuilder.c:226

Open hao47825148 opened this issue 2 years ago • 3 comments

Hi ,

I want to try using example/dynsub to subscribe to a topic with keywords(wchar), Then dynsub will crash.

image

hao47825148 avatar Apr 10 '23 07:04 hao47825148

Are you sure you need wchar? I suspect the crash has something to do with that, IINM we don't support wchar fully.

Anyway, a double free is always a bad bug. Do you have a stack trace where it crashes or at least whether it crashes in dynsub or in the libddsc.so? Or even better, a minimal reproducer?

eboasson avatar Apr 17 '23 19:04 eboasson

I found the problem: unsupport type was freed twice. The first free was in ddsi_typebuilder.c:534, if type is UNSUPPORTED it will call typebuilder_type_fini() when get_topic_descriptor(). https://github.com/eclipse-cyclonedds/cyclonedds/blob/4ece3334a608a7f983b9694d5ff3b9b23c6af5cf/src/core/ddsi/src/ddsi_typebuilder.c#L534

The second time was in calling typebuilder_data_free(). https://github.com/eclipse-cyclonedds/cyclonedds/blob/4ece3334a608a7f983b9694d5ff3b9b23c6af5cf/src/core/ddsi/src/ddsi_typebuilder.c#L1889

The reason is : the pointer is not set null after memory is freed in my environment.

I think there are two solutions:

  1. delete first free in in ddsi_typebuilder.c:534;
  2. set pointer=null after free in ddsi_typebuilder.c:236; https://github.com/eclipse-cyclonedds/cyclonedds/blob/4ece3334a608a7f983b9694d5ff3b9b23c6af5cf/src/core/ddsi/src/ddsi_typebuilder.c#L236

Which you think is more appropriate, or you have a better solution?

hao47825148 avatar Apr 18 '23 01:04 hao47825148

@eboasson

hao47825148 avatar Apr 18 '23 01:04 hao47825148