Skip to content

bug: Datarace in HttpRESTClient #17

Description

@abdulkareem-siddiq

The class is not safely movable and not thread-safe for concurrent configure/send without extra locking or explicit ownership guarantees.

  • HttpRESTClient(HttpRESTClient&& src) does not move or initialize singletonInstance or pool.

    • singletonInstance is left empty in the moved-to object.
    • pool is default-constructed again with a lambda capturing the new this, but any pending tasks in the source object still use the old object.
  • pool’s worker lambda captures this by reference:

    • if the source is moved-from or destroyed while async work remains queued, queued tasks can call dispatchCallback(...) / send(...) on a dangling object.
  • configure() and sendAsync() / send() share mutable members without synchronization:

    • _config is mutated in configure() and read in send()/prepareContext().
    • _callback is mutated in configure() and read in sendAsync() / dispatchCallback().
    • These are plain non-atomic objects, so concurrent use is a data race.
  • dispatchCallback may invoke _callback from the worker thread with no lock if arg.callback is empty.

Metadata

Metadata

Labels

bugSomething isn't working

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions