google / google/leveldb

The memory is used after released ??

Open
#1,211 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
39.4k
Forks
8.2k
PR merge metrics
No merged PRs in 30d

Description

Hi all,
This is Qianxin CodeSafe Team, we found a suspicious issue, at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L316
Element "e" is used at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L314
however,function “Unref” is defined at
https://github.com/google/leveldb/blob/23e35d792b9154f922b8b575b12596a4d8664c65/util/cache.cc#L226
where has freed e's memory

Contributor guide

Open the contributing guide

Research direction

Start in util/cache.cc at the linked lines around the use of element "e" and the Unref definition. Trace the reference-counting and release paths to determine whether the reported access can occur after e is freed, then verify the result with an appropriate reproducer or test. Done means the report is confirmed with a regression test and corrected, or documented as not reproducible.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.