The memory is used after released ??
- Dominant language
- C++
- Stars
- 39.4k
- Forks
- 8.2k
- PR merge metrics
- No merged PRs in 30d
Description
Hi all,
This is Qianxin CodeSafe Team, we found a suspicious issue, at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L316
Element "e" is used at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L314
however,function “Unref” is defined at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L226
where has freed e's memory
Contributor guide
Research direction
Start in util/cache.cc at the linked lines around the use of element "e" and the Unref definition. Trace the reference-counting and release paths to determine whether the reported access can occur after e is freed, then verify the result with an appropriate reproducer or test. Done means the report is confirmed with a regression test and corrected, or documented as not reproducible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100