From c189fa0e8262465002be9fb3fb930e79b5d81108 Mon Sep 17 00:00:00 2001 From: Adrien Beraud Date: Thu, 3 Sep 2026 00:14:47 -0400 Subject: [PATCH] proxy_server: detach pending push requests before destruction ~DhtProxyServer destroyed requests_ whose ~http::Request notifies DONE; the handler registered by sendPushNotification then erased from the map being destroyed, corrupting the heap (double free under ASan) whenever a push request was still pending, e.g. an unreachable push server. Detach the state-change callbacks and release the requests before the members are destroyed. --- src/dht_proxy_server.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/dht_proxy_server.cpp b/src/dht_proxy_server.cpp index e41f98ba..95e4464a 100644 --- a/src/dht_proxy_server.cpp +++ b/src/dht_proxy_server.cpp @@ -571,6 +571,18 @@ DhtProxyServer::~DhtProxyServer() ioContext_->stop(); if (serverThread_.joinable()) serverThread_.join(); + { + // ~Request notifies DONE and its handler erases from requests_: + // detach pending push requests so nothing calls back into this object. + decltype(requests_) pending; + { + std::lock_guard l(requestLock_); + pending = std::move(requests_); + } + for (auto& r : pending) + r.second->add_on_state_change_callback({}); + pending.clear(); + } if (logger_) logger_->debug("[proxy:server] http server closed"); }