From bbcc6fc596f33f1d3c6d3a3b78aecd635dfd0813 Mon Sep 17 00:00:00 2001 From: Constantin Dimitrov Date: Fri, 22 Aug 2025 02:55:26 +0200 Subject: [PATCH] Fix: segfault due to use after free in workers thread NodeDisconnect calls worker.WorkComplete() which deletes the callback, while the thread is still alive, creating use after free segmentation fault. --- src/workers.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/workers.h b/src/workers.h index d7d5ac8a..06c43adf 100644 --- a/src/workers.h +++ b/src/workers.h @@ -100,7 +100,9 @@ class MessageWorker : public ErrorAwareWorker { } for (unsigned int i = 0; i < message_queue.size(); i++) { - HandleMessageCallback(message_queue[i], RdKafka::ERR_NO_ERROR); + if (callback && !callback->IsEmpty()) { + HandleMessageCallback(message_queue[i], RdKafka::ERR_NO_ERROR); + } // we are done with it. it is about to go out of scope // for the last time so let's just free it up here. can't rely @@ -108,7 +110,9 @@ class MessageWorker : public ErrorAwareWorker { } for (unsigned int i = 0; i < warning_queue.size(); i++) { - HandleMessageCallback(NULL, warning_queue[i]); + if (callback && !callback->IsEmpty()) { + HandleMessageCallback(NULL, warning_queue[i]); + } } }