BAD_ACCESS on very low number of users during getaddrinfo

Question

Okay, I am completely at a loss here. A small percentage of users seem to have BAD_ACCESS errors in my hostname translation.

The complete crash below:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: 0x000000000000000d, 0x0000000000000000
Crashed Thread:  21

Thread 21 Crashed:
0   libSystem.B.dylib               0x00007fff8406a446 _mdns_query_callback + 275
1   libSystem.B.dylib               0x00007fff84057fc8 handle_query_response + 296
2   libSystem.B.dylib               0x00007fff84057433 DNSServiceProcessResult + 717
3   libSystem.B.dylib               0x00007fff84069cf3 _mdns_query_mDNSResponder + 1180
4   libSystem.B.dylib               0x00007fff84069090 _mdns_search + 1458
5   libSystem.B.dylib               0x00007fff840682f1 _mdns_addrinfo + 716
6   libSystem.B.dylib               0x00007fff84067373 search_addrinfo + 146
7   libSystem.B.dylib               0x00007fff84066d9c si_addrinfo + 1352
8   libSystem.B.dylib               0x00007fff840667ad getaddrinfo + 159
9   com.NZBVortex.NZBVortex         0x000000010002a4d7 -[CFNetworkStream getHostAddress:sockAddressIn:] + 152
10  com.NZBVortex.NZBVortex         0x000000010002a622 -[CFNetworkStream openBSDSocket::] + 252

Here is the code I use to resolve the dns (important parts). Am I missing something here; could I add more checks? It's just an very low number of users, so thousands have no issues.

Part of my hostname resolve code: My [CFNetworkStream openBSDSocket::] method

-(bool)openBSDSocket:(NSString*)hostName:(int)port {
    struct sockaddr_in remoteAddr;

    remoteAddr.sin_family = AF_INET;
    remoteAddr.sin_port = htons(port);

    if ([self getHostAddress:hostName sockAddressIn:&remoteAddr]) {
        //some non-related code
    }
}

Which in turn calls the [self getHostAddress:xxxx] method Below the complete method:

-(bool)getHostAddress:(NSString*)hostname sockAddressIn:(struct sockaddr_in*)result {
    struct addrinfo hints, *res, *iterateRes;
    int retval;

    memset (&hints, 0, sizeof (struct addrinfo));
    hints.ai_family = PF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_flags |= AI_CANONNAME;

    int maxLength = [hostname length]+1;
    const char hostNameC[maxLength];
    struct in_addr *inAddr;
    bool foundAddress = NO;

    if (hostNameC!=NULL) {
        [hostname getCString:(void*)&hostNameC maxLength:maxLength encoding:NSASCIIStringEncoding];

        retval = getaddrinfo (hostNameC, NULL, &hints, &res);
        if (retval == 0) {

            iterateRes = res;
            while (iterateRes && !foundAddress) {
                switch (iterateRes->ai_family)
                {
                    case AF_INET:
                        inAddr = &((struct sockaddr_in *) iterateRes->ai_addr)->sin_addr;
                        memcpy(&(result->sin_addr), inAddr, sizeof(inAddr));
                        foundAddress = YES;
                }
                iterateRes = iterateRes->ai_next;
            }
        }

        freeaddrinfo (res);
    }

    return foundAddress;
}

Could you give me a consult? I really seem to be stuck here, whey are those (low) number of users see issues in this code? Do I need additional checks?

I really could use your tips/consult.

IMPORTANT: the affected users say it only happens if the network gets dropped. But I can't accept that a dropping network connection could create the above problems?

Edit: I did a leak test; a long time by faking no DNS result (if (retval != 0)), but no memory leaks on my Mac.

Answer 1

Well, for one thing the test if (hostNameC!=NULL) is not accomplishing anything: hostnameC is an array (not a pointer), it will never be == NULL. So, are you handling the case where hostname==NULL, or hostname is zero-length?

You aren't checking the return value of -getCString: maxLength: encoding:; if that call fails, you will be passing uninitialized garbage to getaddrinfo.