Repository navigation
Double free from safe code when dropping a cloned Handle #32
Description
Handle derives Clone, which bitwise-copies its pointer field. The Drop implementation for Handle frees the pointee unconditionally, so cloning an instance of Handle and dropping both copies causes a double-free.
#[derive(Clone)]
pub struct Handle {
handle: *mut pcap_sys::pcap_t,
live_capture: bool,
interrupted: std::sync::Arc<std::sync::Mutex<bool>>,
}
impl Drop for Handle {
fn drop(&mut self) {
self.close();
}
}Reproducing:
use pcap_async::Handle;
#[test]
fn handle_double_free() {
let foo = Handle::dead(0, 0).unwrap();
let bar: Handle = (*foo).clone();
drop(bar); // pcap_close(handle)
drop(foo); // SAME pcap_t, closed again
}You can run the above test with valgrind and see an Invalid read error.
cargo test --test repro --no-run
valgrind --leak-check=no ./target/debug/deps/repro-<HASH>
Fix:
- Drop
#[derive(Clone)]onHandle.
Activity
djc commentedon Oct 12, 2026
@dbcfd friendly ping -- are you planning on fixing this?
dbcfd commentedon Oct 12, 2026
You will need to reach out to a member of Protectwise, or fork the repository.
djc commentedon Oct 12, 2026
@protectwise/rust-owners ping?
djc commentedon Oct 12, 2026
Thanks for the quick reply! Do you happen to have a suggestion for any person at Protectwise who might still be active?