Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MQTTProtocol_emptyMessageList() crashes due to null pointer assignment #1532

Open
clappingSeal14 opened this issue Oct 16, 2024 · 1 comment

Comments

@clappingSeal14
Copy link

clappingSeal14 commented Oct 16, 2024

Describe the bug
Within the function MQTTProtocol_emptyMessageList() in MQTTProtocolClient.c when the function attempts to assign the variable Messages* m to current->content it is attempting to assign a null pointer and it crashes.

When the stack trace for the segmentation fault is viewed this call to MQTTProtocol_emptyMessageList() occurs due to a previous call handled in the system to MQTTClient_destroy(). It appears to be having trouble freeing the inbound message list for the client getting destroyed.

For our project we brought in the repository as a submodule and are using the source code of PAHO to handle our MQTT logic. All of our business logic is handled on one thread while all of the MQTT logic is handled on the second thread.

Additional Information

  • The client that is being destroyed is not null and has valid fields
  • After reading similar issues to this, increased the inflight messagetimeout being used to 10000ms but the system still crashed

To Reproduce
When performing network stress tests of the system that receives a message from the broker every 1000ms and responds to it, this behavior is seen when a device in our application has it's connection loss leading us to destroy the previously existing client. This failure does not occur for every call to MQTTClient_destroy() however it is more likely to appear the longer the stress test runs.

Expected behavior
Application behaves as normal without unexpected crashing

Screenshots
Stack trace of the segmentation fault:
stackTrace

Value of msgList within the function causing the segmentation fault (size appears unreasonable):
msgList

Log files
NewestGdbDump.txt

Environment:

  • Host OS: Ubuntu
  • Remote Debug Target: Linux beaglebone 4.19.94-ti-r42 #1buster SMP PREEMPT Tue Mar 31 19:38:29 UTC 2020 armv7l GNU/Linux (Debian IOT)
  • PAHO MQTT Version: 1.3.13
@FunnyFossils
Copy link

Anyone else run into this issue I saw it the other day and was wondering if anyone else had encounter this before I'm trying to migrate over to the MQTTAsync client library in hopes to get around some memory freeing issues that seem to occur occasionally

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants