Invalid memory read in io_context::executor_type::post

Hi all,

The continuation version of io_context::executor_type::post [1] seems
to cause an invalid read when submitting operations that don't inherit
from continuation_op. try_from_continuation [2] will attempt to read a
magic number. In continuation_op, the magic is before the continuation
member [3]. If the submitted operation doesn't inherit from
continuation_op, this leads to reading potentially unmapped memory.

Reproducer (build with -fsanitize=address):

struct my_awaitable {
   capy::continuation* cont;

   bool await_ready() const { return false; }
   std::coroutine_handle<> await_suspend(
      std::coroutine_handle<> h,
      capy::io_env const* env) noexcept
   {
      cont->h = h;
      env->executor.post(*cont);
      return std::noop_coroutine();
   }

   int await_resume() const { return 42; }
};

capy::task<void> co_main()
{
   auto cont = std::make_unique<capy::continuation>();
   my_awaitable aw{cont.get()};
   int v = co_await aw;
   std::cout << "The value is: " << v << std::endl;
}

I've also raised an issue in the repo [4].

[1] https://github.com/cppalliance/corosio/blob/4276bd4039097fd4dd62dda4bb55e53d03351088/include/boost/corosio/io_context.hpp#L604
[2] https://github.com/cppalliance/corosio/blob/4276bd4039097fd4dd62dda4bb55e53d03351088/include/boost/corosio/detail/continuation_op.hpp#L85
[3] https://github.com/cppalliance/corosio/blob/4276bd4039097fd4dd62dda4bb55e53d03351088/include/boost/corosio/detail/continuation_op.hpp#L41
[4] https://github.com/cppalliance/corosio/issues/290
_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/42BU6CCSKZOBS4IILER3EXZZAN2VU5KQ/