#4926·libzmq

ctx_t::send_command() 中的竞态条件在并发关闭套接字时导致 UAF

作者: surprized创建于 2026年8月11日更新于 2026年8月11日

This is a race condition in `ctx_t::send_command()` where it dereferences `_slots[tid_]` while `destroy_socket()` concurrently nulls and frees that slot under `_slot_sync` which results in a UAF (caught by ASan), or a SIGSEGV in `signaler_t::send()` on non-instrumented builds of libzmq users.