Skip to content

scaled range timer manager: potential use-after-free when disabling timer during another timer's callback #14798

@chradcliffe

Description

@chradcliffe

Description:
During the triggering of a callback for a ScaledRangeTimerManagerImpl timer, if another timer in the same queue is disabled such that the queue becomes empty, the queue will be deleted. This will result in a use-after-free error in the loop inside ScaledRangeTimerManagerImpl::onQueueTimerFired when checking !timers.empty().

This issue does not seem to be possible in mainline Envoy, since there are very few places that the scaled range timers are currently used; however, our internal modifications of Envoy have hit this issue and it is reproducible in a unit test.

Repro steps:
See chradcliffe@6666db7 for a minimal unit test that reproduces the issue when run under ASAN.

Metadata

Metadata

Labels

bugstalestalebot believes this issue/PR has not been touched recently

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions