mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
c29ea0221b
## Summary - free non-NULL Hiredis async contexts returned with an error - clean up partially initialized libevent state in attach and reconnect paths - keep failed reconnect state retryable - add real Hiredis/libevent fault-injection regression tests ## Problem `redisAsyncConnect()` can return a non-NULL context with `ac->err` set. The caller still owns that context, but the initial attach path did not free it, while the reconnect path could treat it as a valid connection. If either `event_new()` call failed, the initial attach path freed only its wrapper, while reconnect retained a partial context/event state. Cleanup must go through `redisAsyncFree()` because the registered libevent cleanup callback owns the events. Freeing those events separately would result in a double-free. ## Fix - call `redisAsyncFree()` for Hiredis error contexts - clean up the async context when either event allocation fails - release attach-only wrapper strings after context cleanup - reset the reconnect context to `NULL` so a later retry can succeed ## Testing The new test uses the real Hiredis and libevent implementations. It wraps only `event_new()` to inject deterministic read/write event allocation failures. It covers: - Hiredis error contexts during initial attach and reconnect - read and write event allocation failures - successful retry after reconnect setup fails Results: - same unpatched commit plus the regression test: 6/6 cases fail - patched ASan/UBSan/LSan regression test: 6/6 cases pass - patched ASan/UBSan/LSan CTest: 16/16 pass when excluding the pre-existing `test_turn_ports` teardown leak - Release build and CTest: 17/17 pass - `turnutils_rfc5769check`: all checks pass - `git diff --check` and clang-format check pass ## Tool-assisted discovery This was found while evaluating Vul-RAG and PailGen on coturn. PailGen's initial event-failure cleanup draft conflicted with Hiredis' cleanup callback and was rejected after ASan detected a double-free. The final cleanup and regression tests were manually ownership-reviewed and validated using the real libraries. This is presented as a robustness and resource-cleanup fix. I am not claiming a demonstrated remote security impact. Signed-off-by: Junki Lee <junkilee80@gmail.com>