Crash w/ "FORTIFY: pthread_mutex_destroy called on a destroyed mutex (0x<sanitized>)"

[bk138]

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
pid: 0, tid: 17495 >>> net.christianbeier.droidvnc_ng <<<

backtrace:
  #00  pc 0x0000000000082fb4  /apex/com.android.runtime/lib64/bionic/libc.so (abort+160)
  #01  pc 0x00000000000e35e8  /apex/com.android.runtime/lib64/bionic/libc.so (__fortify_fatal(char const*, ...)+116)
  #02  pc 0x00000000000e2d1c  /apex/com.android.runtime/lib64/bionic/libc.so (HandleUsingDestroyedMutex(pthread_mutex_t*, char const*)+52)
  #03  pc 0x00000000000e3560  /apex/com.android.runtime/lib64/bionic/libc.so (pthread_mutex_destroy+140)
  #04  pc 0x000000000002458c  /data/app/net.christianbeier.droidvnc_ng-lNwW2EzuNHLeix08Va0GNg==/split_config.arm64_v8a.apk!libvncserver.so (rfbClientConnectionGone+642)
  #05  pc 0x00000000000226cc  /data/app/net.christianbeier.droidvnc_ng-lNwW2EzuNHLeix08Va0GNg==/split_config.arm64_v8a.apk!libvncserver.so (clientInput+611)
  #06  pc 0x00000000000e205c  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+36)
  #07  pc 0x0000000000084af0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64)
  

• which points to https://github.com/LibVNC/libvncserver/blob/8560a5a72d76fc3ab3484ca41f604116807f34e8/src/libvncserver/rfbserver.c#L642
• this is the only place where cl->updateMutex is shutdown
• which means that rfbClientConnectionGone() must be called more than once per client 💣
• calls of rfbClientConnectionGone() occur in (unlikely/impossible crash candidates striked)
  • in clientInput(): https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/main.c#L611
    • this is where it's crashing
  • in refuseOnHoldClient() https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/main.c#L714
    • never called
  • in rfbScreenCleanup() https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/main.c#L1159
    • 💣 crash reproducible when adding a sleep(2) in clientInput() just before the rfbCloseSocket()
  • in rfbShutdownServer() https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/main.c#L1216
    • improbable as cl->screen->backgroundLoop is set
  • in rfbProcessEvents() https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/main.c#L1283
  • in rfbNewTCPOrUDPClient() after a failed websockets check https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/rfbserver.c#L482
  • also there, after a failed protocol version write https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/rfbserver.c#L502
  • also there, after newClientHook says refuse https://github.com/LibVNC/libvncserver/blob/570d1bdee109d87ff50e9371879bcf6ca7490149/src/libvncserver/rfbserver.c#L526