Weird Segfault after parsing json and trying to return

[0x7d8]

I am trying to recieve a json body in uWS by adding all chunks to a string and parsing it when last is true, the json parsing works fine but when I want to return an early response because of missing json data the program segfaults, I tried removing any response part and it did not segfault, instead the client just waiting for a response (obviously).

https://pastes.dev/RRV6fw7mDA#L93

I am quite new to C++ itself so please dont be too harsh if its obvious.

[uNetworkingAB]

Use AddressSanitizer and you will find your issue. Most likely heap-use-after-free.

[0x7d8]

I tried AddressSanitizer and it gave me the following error:

    #0 0x61147c1b06fd in auto main::{lambda(auto:1*, auto:2*)#1}::operator()<uWS::HttpResponse<false>, uWS::HttpRequest>(uWS::HttpResponse<false>*, uWS::HttpRequest*) const (/root/projects/cpp/webserver-testing/Papyrus+0x236fd) (BuildId: d180c569e7c2a88a6cc3b2eb09f82dea4c4cf589)

  This frame has 10 object(s):
    [48, 49) 'closed' (line 86)
    [64, 72) '<unknown>'
    [96, 104) 'res' (line 74)
    [128, 144) '<unknown>'
    [160, 176) '<unknown>'
    [192, 224) '<unknown>'
    [256, 288) '<unknown>'
    [320, 352) 'body' (line 85) <== Memory access at offset 336 is inside this variable
    [384, 416) '<unknown>'
    [448, 480) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-return ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
  0x74e7cfd12080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x74e7cfd12100: f5 f5 f5 f5 00 00 00 00 00 00 00 00 00 00 00 00
  0x74e7cfd12180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x74e7cfd12200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x74e7cfd12280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x74e7cfd12300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5
  0x74e7cfd12380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x74e7cfd12400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x74e7cfd12480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x74e7cfd12500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x74e7cfd12580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==654218==ABORTING```

I assume this means that body is being used after being destroyed?

[uNetworkingAB]

Papyrus+0x236fd

This is an offset in your binary. If you compile with -g you will see line numbers instead.

[uNetworkingAB]

Aha yes. On line 85 you create std::string body on the stack then you capture it by ref in onData and let it die. You can do like this instead:

std::string body;

res->onData([body = std::move(body)]() {

})

[uNetworkingAB]

And you probably need to mark your lambda mutable. I have an example for this

[0x7d8]

Wont this make body immutable within the callback?

[0x7d8]

for some reason even if I fully remove the body and closed variables it still errors

https://pastes.dev/DIzjjYFKqi#L87

    #0 0x5beace4753ed in operator()<uWS::HttpResponse<false>, uWS::HttpRequest> /root/projects/cpp/webserver-testing/src/main.cpp:74

  This frame has 8 object(s):
    [48, 49) '<unknown>'
    [64, 72) '<unknown>'
    [96, 104) 'res' (line 74) <== Memory access at offset 96 is inside this variable
    [128, 144) '<unknown>'
    [160, 176) '<unknown>'
    [192, 224) '<unknown>'
    [256, 288) '<unknown>'
    [320, 352) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-return /root/projects/cpp/webserver-testing/src/main.cpp:96 in operator()
Shadow bytes around the buggy address:
  0x72abf3f11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x72abf3f12000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x72abf3f12080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x72abf3f12100: f5 f5 f5 f5 00 00 00 00 00 00 00 00 00 00 00 00
  0x72abf3f12180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x72abf3f12200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5
  0x72abf3f12280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x72abf3f12300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x72abf3f12380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x72abf3f12400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x72abf3f12480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==710471==ABORTING```

[uNetworkingAB]

Happy debugging then