Skip to content

Double DEL_PEER in handle_alert() #269

@Wang-jiong-han

Description

@Wang-jiong-han

File : dtls.c
Function : handle_alert() (line ~4517) and dtls_destroy_peer() (line ~2205)
When a DTLS peer sends a fatal alert or close_notify, the handle_alert() function removes the peer from the hash table via DEL_PEER() , then calls dtls_destroy_peer() which attempts to remove the same peer again . This double removal corrupts the uthash hash table and can lead to crashes or undefined behavior.

The DEL_PEER macro expands to HASH_DELETE() , which removes an entry from the uthash hash table. When called twice on the same peer:

  1. First call : Correctly removes the peer from the hash table
  2. Second call : Operates on an entry that is no longer in the hash table
    The HASH_DELETE_HH implementation in uthash.h does not check if the entry is actually in the table before attempting removal. This leads to:
    Corrupted hash table bucket chains
    Incorrect num_items counter
    Potential use-after-free if memory is reallocated between calls
    Possible NULL pointer dereference in edge cases

Please confirm whether this is a bug or an intentional design that I haven't understood.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinggood first issueGood for newcomersplease retestPlease retest the related PR or commit, if that works for you

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions