From 41d1c73b9c44725c26bc65ec2d185e474cef52ea Mon Sep 17 00:00:00 2001 From: Junhyun Shim Date: Mon, 2 May 2022 09:48:43 +0200 Subject: [PATCH] Fix TokenSign copying and using uninitialized arena TokenSign was copying unused Arena held by Standalone instead of refering to it. An Arena has to be used at least once before it holds a valid, copyable reference. Otherwise the lifecycle of the copied Arena would be its own and not be shared with the original. Thus, when the copied arena went out of scope, the memory supposed to be held by returned Standalone also got released. Fix: instead of copying, refer to Standalone's arena. --- fdbrpc/TokenSign.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fdbrpc/TokenSign.cpp b/fdbrpc/TokenSign.cpp index fc9396befb..4f872b7115 100644 --- a/fdbrpc/TokenSign.cpp +++ b/fdbrpc/TokenSign.cpp @@ -114,7 +114,7 @@ Standalone generateEcdsaKeyPair() { Standalone signToken(AuthTokenRef token, StringRef keyName, StringRef privateKeyDer) { auto ret = Standalone{}; - auto arena = ret.arena(); + auto& arena = ret.arena(); auto writer = ObjectWriter([&arena](size_t len) { return new (arena) uint8_t[len]; }, IncludeVersion()); writer.serialize(token); auto tokenStr = writer.toStringRef(); @@ -181,7 +181,7 @@ TEST_CASE("/fdbrpc/TokenSign") { for (auto i = 0; i < numIters; i++) { auto keyPair = generateEcdsaKeyPair(); auto token = Standalone{}; - auto arena = token.arena(); + auto& arena = token.arena(); auto& rng = *deterministicRandom(); token.expiresAt = timer_monotonic() * (0.5 + rng.random01()); if (auto setIp = rng.randomInt(0, 3)) {