diff options
author | Tao Bao <tbao@google.com> | 2018-12-27 14:12:14 -0800 |
---|---|---|
committer | Tao Bao <tbao@google.com> | 2018-12-27 14:56:04 -0800 |
commit | 028ea416dcde6c54b398567769164b8bc75baa1c (patch) | |
tree | 8b507f844b4468c28e9d48a9d95cb70e4e6a682f /scripts/update_payload/format_utils.py | |
parent | fcfbda2c72f1f301f5f0ec548b68961bc696d3be (diff) |
MultiRangeHttpFetcher::ReceivedBytes should signal the caller correctly.
HttpFetcherDelegate::ReceivedBytes requires a delegate to return false
to signal the caller to terminate. However, the overload in
MultiRangeHttpFetcher::ReceivedBytes missed that and wrongly returned
true instead.
As a result, we observed the following crash while running an ASAN
build.
FileFetcher::OnReadDoneCallback()
|
| called its delegate of MultiRangeHttpFetcher
|
-- MultiRangeHttpFetcher::ReceivedBytes()
|
| requested fetchers to terminate
|
-- fetcher->TerminateTransfer()
|
|-- MultiRangeHttpFetcher::TerminateTransfer()
|
-- FileFetcher::TerminateTransfer()
|
-- MultiRangeHttpFetcher::TransferTerminated()
|
|-- DownloadAction::TransferTerminated()
|
|-- ActionProcessor::ActionComplete()
|
| DownloadAction / MultiRangeHttpFetcher /
| FileFetcher all destroyed
|
| (but it didn't signal the caller to terminate)
|
| FileFetcher proceeded to call FileFetcher::ScheduleRead() that accessed
| already freed memory
While fixing the above issue, a separate bug in
LibcurlHttpFetcher::LibcurlWrite was uncovered, where in_write_callback_
wasn't properly reset.
Bug: 120577143
Test: Build and flash an ASAN build on taimen. Applying a payload with
file:// no longer crashes with tag-mismatch.
Test: Run update_engine_unittests.
Change-Id: I66c862ae40accbfaddc41fb8590b152c2169eea6
Diffstat (limited to 'scripts/update_payload/format_utils.py')
0 files changed, 0 insertions, 0 deletions