[rabbitmq-discuss] rabbitmq-c with high availability

Mon Nov 5 17:04:40 GMT 2012

So the following loop:

   for (int k = 0; k < table.num_entries; k++) {
*       free(table.entries[k].value.value.array.entries);*
   }

This would only work if table.entries[k].kind == AMQP_FIELD_KIND_ARRAY.  If
kind is something else, you get undefined behavior, which is what you're
getting.

-Alan

On Mon, Nov 5, 2012 at 10:31 AM, Arun Chandrasekaran <visionofarun at gmail.com
> wrote:

> Hi all,
>
> Has anyone used rabbitmq-c with high availability configuration?
>
> I am stuck with a double free corruption when using rabbitmq-c with high
> availability configuration. For HA, since the nodes names have to be taken
> from a config file, I have implemented the following way of getting the key
> value params.
>
>    amqp_table_t table;
>    std::vector<amqp_field_value_t_ *> array_ptrs;
>
>    memset(&table, 0, sizeof(table));
>    table.num_entries = ha_map.size();
>    if (table.num_entries)
>        table.entries = (amqp_table_entry_t *) calloc(1,
> sizeof(amqp_table_entry_t) * table.num_entries);
>    int i = 0;
>
>    std::map<std::string, std::vector<std::string> >::const_iterator it;
>    for (it = ha_map.begin(); it != ha_map.end(); it++, i++) {
>       table.entries[i].key.len = (*it).first.size();
>       table.entries[i].key.bytes = (void *) (*it).first.c_str();
>
>       if ((*it).second.size() == 1) {
>          table.entries[i].value.kind = AMQP_FIELD_KIND_UTF8;
>          table.entries[i].value.value.bytes.len = (*it).second[0].size();
>          table.entries[i].value.value.bytes.bytes = (void *)
> (*it).second[0].c_str();
>
>       } else if ((*it).second.size() > 1) {
>          table.entries[i].value.kind = AMQP_FIELD_KIND_ARRAY;
>          table.entries[i].value.value.array.num_entries =
> (*it).second.size();
>          amqp_field_value_t *f = (amqp_field_value_t_ *)
> malloc(sizeof(amqp_field_value_t_) * (*it).second.size());
>          array_ptrs.push_back(f);
>          table.entries[i].value.value.array.entries = f;
>          LogInfo(("Before pointer: %p",
> table.entries[i].value.value.array.entries));
>          for (size_t j = 0; j < (*it).second.size(); j++) {
>             table.entries[i].value.value.array.entries[j].kind =
> AMQP_FIELD_KIND_UTF8;
>             table.entries[i].value.value.array.entries[j].value.bytes.len
> = (*it).second[j].size();
>
> table.entries[i].value.value.array.entries[j].value.bytes.bytes = (void *)
> (*it).second[j].c_str();
>          }
>          LogInfo(("Before1 pointer: %p",
> table.entries[i].value.value.array.entries));
>       }
>    }
>
>    amqp_queue_declare_ok_t *r =
>       amqp_queue_declare(m_conn, m_channel,
> amqp_cstring_bytes(m_queue.c_str()), 0, 1, 0, 0, table);
>
>    for (size_t i = 0; i < array_ptrs.size(); i++) {
>       free(array_ptrs[i]);
>    }
>    free(table.entries);
>
> This works perfectly fine. But the crash happens when I replace
>
>    for (size_t i = 0; i < array_ptrs.size(); i++) {
>       free(array_ptrs[i]);
>    }
>
> with
>    for (int k = 0; k < table.num_entries; k++) {
> *       free(table.entries[k].value.value.array.entries);*
>    }
>
> Am I doing something wrong here? Or is this a bug in the rabbitmq-c
> library itself?
>
> Thanks,
> Arun
>
> _______________________________________________
> rabbitmq-discuss mailing list
> rabbitmq-discuss at lists.rabbitmq.com
> https://lists.rabbitmq.com/cgi-bin/mailman/listinfo/rabbitmq-discuss
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rabbitmq.com/pipermail/rabbitmq-discuss/attachments/20121105/5578f22f/attachment.htm>