win: fix crash when closing a pipe after a failed bind

yury-s · saghul · commit a6d06ba716b6 · 2026-08-06T09:39:55.000+02:00
uv_pipe_pending_instances() sets the UV_HANDLE_PIPESERVER flag before the
pipe is bound. When the subsequent bind fails, e.g. with UV_EADDRINUSE
after losing a bind race on a well-known pipe name, uv_pipe_bind2() frees
accept_reqs and resets it to NULL, but the flag stays set. Closing the
handle then dereferences the NULL accept_reqs array in uv__pipe_close()
(release builds crash with an access violation; debug builds trip the
assert in uv__pipe_endgame()).

Tolerate accept_reqs == NULL at both cleanup sites.
diff --git a/src/win/pipe.c b/src/win/pipe.c
@@ -730,7 +730,8 @@ void uv__pipe_endgame(uv_loop_t* loop, uv_pipe_t* handle) {
   }
 
   if (handle->flags & UV_HANDLE_PIPESERVER) {
-    assert(handle->pipe.serv.accept_reqs);
+    /* accept_reqs is NULL when uv_pipe_pending_instances() was called but
+     * the pipe was never successfully bound. */
     uv__free(handle->pipe.serv.accept_reqs);
     handle->pipe.serv.accept_reqs = NULL;
   }
@@ -1248,11 +1249,15 @@ void uv__pipe_close(uv_loop_t* loop, uv_pipe_t* handle) {
   }
 
   if (handle->flags & UV_HANDLE_PIPESERVER) {
-    for (i = 0; i < handle->pipe.serv.pending_instances; i++) {
-      pipeHandle = handle->pipe.serv.accept_reqs[i].pipeHandle;
-      if (pipeHandle != INVALID_HANDLE_VALUE) {
-        CloseHandle(pipeHandle);
-        handle->pipe.serv.accept_reqs[i].pipeHandle = INVALID_HANDLE_VALUE;
+    /* accept_reqs is NULL when uv_pipe_pending_instances() was called but
+     * the pipe was never successfully bound. */
+    if (handle->pipe.serv.accept_reqs != NULL) {
+      for (i = 0; i < handle->pipe.serv.pending_instances; i++) {
+        pipeHandle = handle->pipe.serv.accept_reqs[i].pipeHandle;
+        if (pipeHandle != INVALID_HANDLE_VALUE) {
+          CloseHandle(pipeHandle);
+          handle->pipe.serv.accept_reqs[i].pipeHandle = INVALID_HANDLE_VALUE;
+        }
       }
     }
     handle->handle = INVALID_HANDLE_VALUE;
diff --git a/test/test-list.h b/test/test-list.h
@@ -220,6 +220,7 @@ TEST_DECLARE   (udp_send_fail_nbufs)
 TEST_DECLARE   (udp_sendmmsg_error)
 TEST_DECLARE   (udp_try_send)
 TEST_DECLARE   (pipe_bind_error_addrinuse)
+TEST_DECLARE   (pipe_bind_error_addrinuse_pending_instances)
 TEST_DECLARE   (pipe_bind_error_addrnotavail)
 TEST_DECLARE   (pipe_bind_error_inval)
 TEST_DECLARE   (pipe_connect_close_multiple)
@@ -881,6 +882,7 @@ TASK_LIST_START
 #endif
 
   TEST_ENTRY  (pipe_bind_error_addrinuse)
+  TEST_ENTRY  (pipe_bind_error_addrinuse_pending_instances)
   TEST_ENTRY  (pipe_bind_error_addrnotavail)
   TEST_ENTRY  (pipe_bind_error_inval)
   TEST_ENTRY  (pipe_connect_close_multiple)
diff --git a/test/test-pipe-bind-error.c b/test/test-pipe-bind-error.c
@@ -73,6 +73,34 @@ TEST_IMPL(pipe_bind_error_addrinuse) {
 }
 
 
+TEST_IMPL(pipe_bind_error_addrinuse_pending_instances) {
+  uv_pipe_t server1, server2;
+  int r;
+
+  r = uv_pipe_init(uv_default_loop(), &server1, 0);
+  ASSERT_OK(r);
+  uv_pipe_pending_instances(&server1, 32);
+  r = uv_pipe_bind(&server1, TEST_PIPENAME);
+  ASSERT_OK(r);
+
+  r = uv_pipe_init(uv_default_loop(), &server2, 0);
+  ASSERT_OK(r);
+  uv_pipe_pending_instances(&server2, 32);
+  r = uv_pipe_bind(&server2, TEST_PIPENAME);
+  ASSERT_EQ(r, UV_EADDRINUSE);
+
+  uv_close((uv_handle_t*)&server1, close_cb);
+  uv_close((uv_handle_t*)&server2, close_cb);
+
+  uv_run(uv_default_loop(), UV_RUN_DEFAULT);
+
+  ASSERT_EQ(2, close_cb_called);
+
+  MAKE_VALGRIND_HAPPY(uv_default_loop());
+  return 0;
+}
+
+
 TEST_IMPL(pipe_bind_error_addrnotavail) {
   uv_pipe_t server;
   int r;

Original file line number	Diff line number	Diff line change
`@@ -730,7 +730,8 @@ void uv__pipe_endgame(uv_loop_t* loop, uv_pipe_t* handle) {`
`730`	`730`	`}`
`731`	`731`
`732`	`732`	`if (handle->flags & UV_HANDLE_PIPESERVER) {`
`733`		`- assert(handle->pipe.serv.accept_reqs);`
	`733`	`+ /* accept_reqs is NULL when uv_pipe_pending_instances() was called but`
	`734`	`+ * the pipe was never successfully bound. */`
`734`	`735`	`uv__free(handle->pipe.serv.accept_reqs);`
`735`	`736`	`handle->pipe.serv.accept_reqs = NULL;`
`736`	`737`	`}`
`@@ -1248,11 +1249,15 @@ void uv__pipe_close(uv_loop_t* loop, uv_pipe_t* handle) {`
`1248`	`1249`	`}`
`1249`	`1250`
`1250`	`1251`	`if (handle->flags & UV_HANDLE_PIPESERVER) {`
`1251`		`- for (i = 0; i < handle->pipe.serv.pending_instances; i++) {`
`1252`		`- pipeHandle = handle->pipe.serv.accept_reqs[i].pipeHandle;`
`1253`		`- if (pipeHandle != INVALID_HANDLE_VALUE) {`
`1254`		`- CloseHandle(pipeHandle);`
`1255`		`- handle->pipe.serv.accept_reqs[i].pipeHandle = INVALID_HANDLE_VALUE;`
	`1252`	`+ /* accept_reqs is NULL when uv_pipe_pending_instances() was called but`
	`1253`	`+ * the pipe was never successfully bound. */`
	`1254`	`+ if (handle->pipe.serv.accept_reqs != NULL) {`
	`1255`	`+ for (i = 0; i < handle->pipe.serv.pending_instances; i++) {`
	`1256`	`+ pipeHandle = handle->pipe.serv.accept_reqs[i].pipeHandle;`
	`1257`	`+ if (pipeHandle != INVALID_HANDLE_VALUE) {`
	`1258`	`+ CloseHandle(pipeHandle);`
	`1259`	`+ handle->pipe.serv.accept_reqs[i].pipeHandle = INVALID_HANDLE_VALUE;`
	`1260`	`+ }`
`1256`	`1261`	`}`
`1257`	`1262`	`}`
`1258`	`1263`	`handle->handle = INVALID_HANDLE_VALUE;`