[Xorp-hackers] xorpsh crash

[Ben Greear]

Ok, the CLI code is harder to fix that I thought it would be!

It seems that when you type 'exit', the

RouterCLI::logout_func()

is called, which then calls _cli_node.delete_client

But, that client that it's deleting originally called the method,
so we end up referencing stale memory when we return back up the
call-stack.  Here's the stack reported
by valgrind.  The line numbers might be slightly off due to debugging
code I added.

==29005==  Address 0x48932D2 is 330 bytes inside a block of size 356 free'd
==29005==    at 0x4004E26: operator delete(void*) (vg_replace_malloc.c:244)
==29005==    by 0x80D4D43: CliClient::~CliClient() (cli_client.cc:193)
==29005==    by 0x80E225B: CliNode::delete_client(CliClient*, std::string&) (cli_node.cc:635)
==29005==    by 0x80548ED: RouterCLI::logout_func(std::string const&, std::string const&, unsigned, std::vector<std::string, std::allocator<std::string> > const&, std::vector<std::string, std::allocator<std::string> > const&) (cli.cc:1878)
==29005==    by 0x806D332: XorpMemberCallback5B0<int, RouterCLI, std::string const&, std::string const&, unsigned, std::vector<std::string, std::allocator<std::string> > const&, std::vector<std::string, std::allocator<std::string> > const&>::dispatch(std::string const&, std::string const&, unsigned, std::vector<std::string, std::allocator<std::string> > const&, std::vector<std::string, std::allocator<std::string> > const&) (callback_nodebug.hh:11110)
==29005==    by 0x80D224E: CliClient::process_command(std::string const&) (cli_client.cc:1520)
==29005==    by 0x80D3375: CliClient::process_char(std::string const&, unsigned char, bool&) (cli_client.cc:1234)
==29005==    by 0x80EBA3D: CliClient::process_input_data() (cli_node_net.cc:849)
==29005==    by 0x80EBE4F: CliClient::client_read(XorpFd, IoEventType) (cli_node_net.cc:764)
==29005==    by 0x80EDB31: XorpMemberCallback2B0<void, CliClient, XorpFd, IoEventType>::dispatch(XorpFd, IoEventType) (callback_nodebug.hh:4635)
==29005==    by 0x8185551: SelectorList::Node::run_hooks(SelectorMask, XorpFd) (selector.cc:149)
==29005==    by 0x8184298: SelectorList::wait_and_dispatch(TimeVal&) (selector.cc:435)


-- 
Ben Greear <greearb at candelatech.com>
Candela Technologies Inc  http://www.candelatech.com