Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
25.10
-
None
-
MXS-SPRINT-280
Description
A router session that does blocking work on thread pool threads, and keeps itself alive with a shared_ptr meanwhile, may outlive its ServiceEndpoint, but has no way of finding out that the endpoint, and with it the Session, has been closed. The use count cannot be used for the purpose, as the thread pool task holds a reference of its own. When the task then continues on the worker, e.g. to deliver a result to the client, it runs against a destroyed Session, which leads to a heap-use-after-free. A router session of that kind must therefore be told when its endpoint is closed.