Repository navigation
win: fix crash when closing a pipe after a failed bind - #5224
Merged
Merged
Conversation
uv_pipe_pending_instances() sets the UV_HANDLE_PIPESERVER flag before the pipe is bound. When the subsequent bind fails, e.g. with UV_EADDRINUSE after losing a bind race on a well-known pipe name, uv_pipe_bind2() frees accept_reqs and resets it to NULL, but the flag stays set. Closing the handle then dereferences the NULL accept_reqs array in uv__pipe_close() (release builds crash with an access violation; debug builds trip the assert in uv__pipe_endgame()). Tolerate accept_reqs == NULL at both cleanup sites.
saghul
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uv_pipe_pending_instances()sets theUV_HANDLE_PIPESERVERflag before the pipe is bound. When the subsequent bind fails (e.g. withUV_EADDRINUSEafter losing a bind race on a well-known pipe name),uv_pipe_bind2()freesaccept_reqsand resets it toNULL, but the flag stays set. Closing the handle then dereferences theNULLaccept_reqsarray inuv__pipe_close()— release builds crash with an access violation, debug builds trip the assert inuv__pipe_endgame().This PR tolerates
accept_reqs == NULLat both cleanup sites and adds a regression test (pipe_bind_error_addrinuse_pending_instances), which crashes with 0xC0000005 without the fix and passes with it.Refs: nodejs/node#65057 (crash is reachable from Node.js via
NODE_PENDING_PIPE_INSTANCES; reproduces on Node 22/24/26)