New QUIC transport requires attention

[JaylinYu]

==119505==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000017b00 at pc 0x55555577b2a9 bp 0x7fffeafea840 sp 0x7fffeafea838
READ of size 4 at 0x60f000017b00 thread T21
2023-11-02 21:22:05 [119526] INFO /home/jaylin/Projects/nanomq/nanomq/bridge.c:217 send_callback: bridge: subscribe aio result 0
2023-11-02 21:22:05 [119526] INFO /home/jaylin/Projects/nanomq/nanomq/bridge.c:219 send_callback: bridge: suback code 1
#0 0x55555577b2a8 in nni_msg_get_type /home/jaylin/Projects/nanomq/nng/src/core/message.c:752:20
#1 0x5555557682b4 in nng_msg_get_type /home/jaylin/Projects/nanomq/nng/src/nng.c:2257:9
#2 0x55555570338b in send_callback /home/jaylin/Projects/nanomq/nanomq/bridge.c:214:9
#3 0x5555557ff224 in nng_mqtt_client_send_cb /home/jaylin/Projects/nanomq/nng/src/supplemental/mqtt/mqtt_public.c:831:2
#4 0x55555578da22 in nni_taskq_thread /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:50:4
#5 0x55555578f0dd in nni_thr_wrap /home/jaylin/Projects/nanomq/nng/src/core/thread.c:94:3
#6 0x555555798bb7 in nni_plat_thr_main /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:266:2
#7 0x7ffff7694ac2 in start_thread nptl/./nptl/pthread_create.c:442:8
#8 0x7ffff7726a3f misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x60f000017b00 is located 0 bytes inside of 168-byte region [0x60f000017b00,0x60f000017ba8)
freed by thread T16 here:
#0 0x5555556b95e2 in free (/home/jaylin/Projects/nanomq/build/nanomq/nanomq+0x1655e2) (BuildId: 734367be7e015d8d8c83a8272a63b77f74d38727)
#1 0x5555557948c8 in nni_free /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_alloc.c:33:2
#2 0x555555777fed in nni_msg_free /home/jaylin/Projects/nanomq/nng/src/core/message.c:465:3
#3 0x5555557501c4 in nng_msg_free /home/jaylin/Projects/nanomq/nng/src/nng.c:1522:2
#4 0x5555557034d2 in send_callback /home/jaylin/Projects/nanomq/nanomq/bridge.c:221:3
#5 0x5555557ff224 in nng_mqtt_client_send_cb /home/jaylin/Projects/nanomq/nng/src/supplemental/mqtt/mqtt_public.c:831:2
#6 0x55555578da22 in nni_taskq_thread /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:50:4
#7 0x55555578f0dd in nni_thr_wrap /home/jaylin/Projects/nanomq/nng/src/core/thread.c:94:3
#8 0x555555798bb7 in nni_plat_thr_main /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:266:2
#9 0x7ffff7694ac2 in start_thread nptl/./nptl/pthread_create.c:442:8

previously allocated by thread T15 here:
#0 0x5555556b9a78 in __interceptor_calloc (/home/jaylin/Projects/nanomq/build/nanomq/nanomq+0x165a78) (BuildId: 734367be7e015d8d8c83a8272a63b77f74d38727)
#1 0x555555794884 in nni_zalloc /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_alloc.c:26:19
#2 0x555555778479 in nni_msg_alloc /home/jaylin/Projects/nanomq/nng/src/core/message.c:387:11
#3 0x555555bc3642 in mqtt_quictran_pipe_recv_cb /home/jaylin/Projects/nanomq/nng/src/mqtt/transport/quic/mqtt_quic.c:666:13
#4 0x55555578da22 in nni_taskq_thread /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:50:4
#5 0x55555578f0dd in nni_thr_wrap /home/jaylin/Projects/nanomq/nng/src/core/thread.c:94:3
#6 0x555555798bb7 in nni_plat_thr_main /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:266:2
#7 0x7ffff7694ac2 in start_thread nptl/./nptl/pthread_create.c:442:8

Thread T21 created by T0 here:
#0 0x5555556a2d0c in pthread_create (/home/jaylin/Projects/nanomq/build/nanomq/nanomq+0x14ed0c) (BuildId: 734367be7e015d8d8c83a8272a63b77f74d38727)
#1 0x5555557989f0 in nni_plat_thr_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:279:7
#2 0x55555578ee2d in nni_thr_init /home/jaylin/Projects/nanomq/nng/src/core/thread.c:121:12
#3 0x55555578d729 in nni_taskq_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:95:8
#4 0x55555578e8f4 in nni_taskq_sys_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:294:10
#5 0x5555557735ec in nni_init_helper /home/jaylin/Projects/nanomq/nng/src/core/init.c:35:13
#6 0x555555799015 in nni_plat_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:422:12
#7 0x5555557735cf in nni_init /home/jaylin/Projects/nanomq/nng/src/core/init.c:58:10
#8 0x5555557fc680 in nng_mtx_alloc /home/jaylin/Projects/nanomq/nng/src/supplemental/util/platform.c:93:9
#9 0x555555b3d1e7 in conf_bridge_node_parse_with_name /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2677:2
#10 0x555555b3c278 in conf_bridge_content_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2870:28
#11 0x555555b2f2e5 in conf_bridge_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2885:2
#12 0x555555b2b227 in conf_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:608:2
#13 0x55555574d719 in broker_start /home/jaylin/Projects/nanomq/nanomq/apps/broker.c:1582:3
#14 0x5555556f77a7 in main /home/jaylin/Projects/nanomq/nanomq/nanomq.c:142:10
#15 0x7ffff7629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Thread T16 created by T0 here:
#0 0x5555556a2d0c in pthread_create (/home/jaylin/Projects/nanomq/build/nanomq/nanomq+0x14ed0c) (BuildId: 734367be7e015d8d8c83a8272a63b77f74d38727)
#1 0x5555557989f0 in nni_plat_thr_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:279:7
#2 0x55555578ee2d in nni_thr_init /home/jaylin/Projects/nanomq/nng/src/core/thread.c:121:12
#3 0x55555578d729 in nni_taskq_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:95:8
#4 0x55555578e8f4 in nni_taskq_sys_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:294:10
#5 0x5555557735ec in nni_init_helper /home/jaylin/Projects/nanomq/nng/src/core/init.c:35:13
#6 0x555555799015 in nni_plat_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:422:12
#7 0x5555557735cf in nni_init /home/jaylin/Projects/nanomq/nng/src/core/init.c:58:10
#8 0x5555557fc680 in nng_mtx_alloc /home/jaylin/Projects/nanomq/nng/src/supplemental/util/platform.c:93:9
#9 0x555555b3d1e7 in conf_bridge_node_parse_with_name /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2677:2
#10 0x555555b3c278 in conf_bridge_content_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2870:28
#11 0x555555b2f2e5 in conf_bridge_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2885:2
#12 0x555555b2b227 in conf_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:608:2
#13 0x55555574d719 in broker_start /home/jaylin/Projects/nanomq/nanomq/apps/broker.c:1582:3
#14 0x5555556f77a7 in main /home/jaylin/Projects/nanomq/nanomq/nanomq.c:142:10
#15 0x7ffff7629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Thread T15 created by T0 here:
#0 0x5555556a2d0c in pthread_create (/home/jaylin/Projects/nanomq/build/nanomq/nanomq+0x14ed0c) (BuildId: 734367be7e015d8d8c83a8272a63b77f74d38727)
#1 0x5555557989f0 in nni_plat_thr_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:279:7
#2 0x55555578ee2d in nni_thr_init /home/jaylin/Projects/nanomq/nng/src/core/thread.c:121:12
#3 0x55555578d729 in nni_taskq_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:95:8
#4 0x55555578e8f4 in nni_taskq_sys_init /home/jaylin/Projects/nanomq/nng/src/core/taskq.c:294:10
#5 0x5555557735ec in nni_init_helper /home/jaylin/Projects/nanomq/nng/src/core/init.c:35:13
#6 0x555555799015 in nni_plat_init /home/jaylin/Projects/nanomq/nng/src/platform/posix/posix_thread.c:422:12
#7 0x5555557735cf in nni_init /home/jaylin/Projects/nanomq/nng/src/core/init.c:58:10
#8 0x5555557fc680 in nng_mtx_alloc /home/jaylin/Projects/nanomq/nng/src/supplemental/util/platform.c:93:9
#9 0x555555b3d1e7 in conf_bridge_node_parse_with_name /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2677:2
#10 0x555555b3c278 in conf_bridge_content_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2870:28
#11 0x555555b2f2e5 in conf_bridge_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:2885:2
#12 0x555555b2b227 in conf_parse /home/jaylin/Projects/nanomq/nng/src/supplemental/nanolib/conf.c:608:2
#13 0x55555574d719 in broker_start /home/jaylin/Projects/nanomq/nanomq/apps/broker.c:1582:3
#14 0x5555556f77a7 in main /home/jaylin/Projects/nanomq/nanomq/nanomq.c:142:10
#15 0x7ffff7629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/jaylin/Projects/nanomq/nng/src/core/message.c:752:20 in nni_msg_get_type
Shadow bytes around the buggy address:
0x0c1e7fffaf10: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c1e7fffaf20: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x0c1e7fffaf30: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c1e7fffaf40: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c1e7fffaf50: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x0c1e7fffaf60:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c1e7fffaf70: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
0x0c1e7fffaf80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1e7fffaf90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1e7fffafa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1e7fffafb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==119505==ABORTING