Potential concurrency issue? Wrong file names on some requests. about facil.io

[boazsegev]

I cannot test for a bug without example code that introduces the issue. However...

This sounds like a possible double free issue, where you are freeing a FIOBJ object more than once.

This will cause the custom allocator to mark used memory as available and possibly to allocate the same memory to a new variable (causing 2 variables to use the same memory).

Note that all the FIOBJ objects in the HTTP handle are owned by the handle. If you place them into an array or a Hash, you will need to call fiobj_dup in order to acquire another reference.

P.S.

Why not setup a public_folder in the http_listen settings and place that file in the public folder?

Alternatively, consider using the http_sendfile2 function to send a file from a public folder. If the function fails you can still handle the HTTP request manually (this is what the public_folder setting does)...

Since the code already exists (including protection against tree transversal), it could make life easier for you.

[dertuxmalwieder]

I actually use http_sendfile2 for this. :-)
I free all FIOBJs at the end of the on_http_request method, after using any of them. No arrays, no hashes. Are there any other methods that modify them internally?

[boazsegev]

I free all FIOBJs at the end of the on_http_request method

I hope you meant to write that you free all the temporary FIOBJ objects that you yourself created.

Remember that all the FIOBJ objects that come from the HTTP handle are managed by the facil.io framework and should NOT be freed.

For example:

• h->path must NOT be freed.
• Any header value set using http_set_header should NOT be freed, since you moved the memory ownership to the HTTP handle... however: header names, unless cached, should be freed as their ownership remains with you.
• Any FIOBJ header / cookie value collected from the h->headers or h->cookies hash is still owned by the hash and must NOT be freed.

Unless I could reproduce the issue or see some example code, I won't be able to debug the issue... but I hope this helps.

Happy New Year!

[dertuxmalwieder]

I hope you meant to write that you free all the temporary FIOBJ objects that you yourself created.

Yes, sure. Sorry for the confusion. :-)

I think I found the problem. It was, not surprisingly, in my own code. For those having similar issues later, I even quoted the bad part in my initial comment:

char* path_str_clean = path_str.data;

Modifying facil.io-supplied strings from a copy created this way will most likely break somewhere in the code. Fix:

char* path_str_clean = strdup(path_str.data);

I should probably stop writing issues here. Most of them show a lack of basic understanding on my side. 🙄
Happy new year to you as well! I promise: I'll do better in the future.