summaryrefslogtreecommitdiff
path: root/scripts/update_payload/format_utils.py
diff options
context:
space:
mode:
authorTao Bao <tbao@google.com>2018-12-27 14:12:14 -0800
committerTao Bao <tbao@google.com>2018-12-27 14:56:04 -0800
commit028ea416dcde6c54b398567769164b8bc75baa1c (patch)
tree8b507f844b4468c28e9d48a9d95cb70e4e6a682f /scripts/update_payload/format_utils.py
parentfcfbda2c72f1f301f5f0ec548b68961bc696d3be (diff)
MultiRangeHttpFetcher::ReceivedBytes should signal the caller correctly.
HttpFetcherDelegate::ReceivedBytes requires a delegate to return false to signal the caller to terminate. However, the overload in MultiRangeHttpFetcher::ReceivedBytes missed that and wrongly returned true instead. As a result, we observed the following crash while running an ASAN build. FileFetcher::OnReadDoneCallback() | | called its delegate of MultiRangeHttpFetcher | -- MultiRangeHttpFetcher::ReceivedBytes() | | requested fetchers to terminate | -- fetcher->TerminateTransfer() | |-- MultiRangeHttpFetcher::TerminateTransfer() | -- FileFetcher::TerminateTransfer() | -- MultiRangeHttpFetcher::TransferTerminated() | |-- DownloadAction::TransferTerminated() | |-- ActionProcessor::ActionComplete() | | DownloadAction / MultiRangeHttpFetcher / | FileFetcher all destroyed | | (but it didn't signal the caller to terminate) | | FileFetcher proceeded to call FileFetcher::ScheduleRead() that accessed | already freed memory While fixing the above issue, a separate bug in LibcurlHttpFetcher::LibcurlWrite was uncovered, where in_write_callback_ wasn't properly reset. Bug: 120577143 Test: Build and flash an ASAN build on taimen. Applying a payload with file:// no longer crashes with tag-mismatch. Test: Run update_engine_unittests. Change-Id: I66c862ae40accbfaddc41fb8590b152c2169eea6
Diffstat (limited to 'scripts/update_payload/format_utils.py')
0 files changed, 0 insertions, 0 deletions