tarantool / tarantool / 14386099710

88%

master: 88%

Build Type

push

github

Committed by sergepetrenko

Commit Message

box: fix session use-after-free

If session is created on demand in fiber we delete it when fiber is
stopped. But we do not clear session and credentials in fiber storage.
It is not an issue for standalone fiber (outside of fiber pool) as fiber
will be destroyed or recycled and will not have chance to execute any
code before that. In case of fiber pool it become dangerous as fiber is
reused. Fortunately we never hit this because we either reset session
and credentials at start in code executed in fiber (like in iproto) or
execute code that does not check access (like in vinyl).

Recently we add `tnt_tx_push()` to execute callback in TX. This time
the issue is revealed.

Let's just clear session and credentials in fiber storage when fiber
is stopped.

Closes #11267

NO_DOC=bugfix

(cherry picked from commit 73af81f8e)

Run Details

69973 of 123847 branches covered (56.5%)

2 of 2 new or added lines in 1 file covered. (100.0%)

31 existing lines in 11 files now uncovered.

102988 of 117716 relevant lines covered (87.49%)

2236231.58 hits per line