OverviewFilesCommitsIssuesDocsReleasesPeers

hyperswarm-peer commits / 7177173

dht_rpc: read the query id BEFORE _advance_query
_advance_query can complete — and delete — a query with no one to ask (an empty routing table: listen()'s announce at startup). The three query entry points then returned q->id from freed memory. ASan flagged it in test_handshake_pool and test_handshake_dedup; both clean now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71771730ae0cd5f7cda042bf727f4ea4ff9d6d68
by plankatron <fleeky@gmail.com> · 2026-10-01T00:28:25.000Z

Changed files (1) +12 -3

src/dht_rpc.cpp +12 -3
……@@ -185,8 +185,11 @@ uint32_t DhtRpc::query(const uint8_t *target, bool internal, uint32_t command,
185185 }
186186
187187 _queries[_query_count++] = q;
188 // _advance_query may COMPLETE — and delete — a query with no one to ask (an empty
189 // routing table: an announce at startup). Take the id first.
190 const uint32_t id = q->id;
188191 _advance_query(q);
189 return q->id;
192 return id;
190193}
191194
192195uint32_t DhtRpc::query_with_commit(const uint8_t *target, bool internal,
……@@ -227,8 +230,11 @@ uint32_t DhtRpc::query_with_commit(const uint8_t *target, bool internal,
227230 }
228231
229232 _queries[_query_count++] = q;
233 // _advance_query may COMPLETE — and delete — a query with no one to ask (an empty
234 // routing table: an announce at startup). Take the id first.
235 const uint32_t id = q->id;
230236 _advance_query(q);
231 return q->id;
237 return id;
232238}
233239
234240uint32_t DhtRpc::query_with_commit_fn(
……@@ -271,8 +277,11 @@ uint32_t DhtRpc::query_with_commit_fn(
271277 }
272278
273279 _queries[_query_count++] = q;
280 // _advance_query may COMPLETE — and delete — a query with no one to ask (an empty
281 // routing table: an announce at startup). Take the id first.
282 const uint32_t id = q->id;
274283 _advance_query(q);
275 return q->id;
284 return id;
276285}
277286
278287void DhtRpc::on_message(const uint8_t *data, size_t len, const struct sockaddr_in *from) {