fixes #1239 Use after free in tls

Also, addressed a number of Clang-tidy complaints. Potential hangs
in close addressed as well.

3 files changed, 43 insertions, 36 deletions

diff --git a/src/core/defs.h b/src/core/defs.h
index eaba7428..1dffdad0 100644
--- a/src/core/defs.h
+++ b/src/core/defs.h
@@ -85,50 +85,50 @@ typedef struct {
 #define NNI_ALLOC_STRUCTS(s, n) nni_zalloc(sizeof(*s) * n)
 #define NNI_FREE_STRUCTS(s, n) nni_free(s, sizeof(*s) * n)
 
-#define NNI_PUT16(ptr, u)                                   \
-	do {                                                \
-		(ptr)[0] = (uint8_t)(((uint16_t)(u)) >> 8); \
-		(ptr)[1] = (uint8_t)((uint16_t)(u));        \
+#define NNI_PUT16(ptr, u)                                    \
+	do {                                                 \
+		(ptr)[0] = (uint8_t)(((uint16_t)(u)) >> 8u); \
+		(ptr)[1] = (uint8_t)((uint16_t)(u));         \
 	} while (0)
 
-#define NNI_PUT32(ptr, u)                                    \
-	do {                                                 \
-		(ptr)[0] = (uint8_t)(((uint32_t)(u)) >> 24); \
-		(ptr)[1] = (uint8_t)(((uint32_t)(u)) >> 16); \
-		(ptr)[2] = (uint8_t)(((uint32_t)(u)) >> 8);  \
-		(ptr)[3] = (uint8_t)((uint32_t)(u));         \
+#define NNI_PUT32(ptr, u)                                     \
+	do {                                                  \
+		(ptr)[0] = (uint8_t)(((uint32_t)(u)) >> 24u); \
+		(ptr)[1] = (uint8_t)(((uint32_t)(u)) >> 16u); \
+		(ptr)[2] = (uint8_t)(((uint32_t)(u)) >> 8u);  \
+		(ptr)[3] = (uint8_t)((uint32_t)(u));          \
 	} while (0)
 
-#define NNI_PUT64(ptr, u)                                    \
-	do {                                                 \
-		(ptr)[0] = (uint8_t)(((uint64_t)(u)) >> 56); \
-		(ptr)[1] = (uint8_t)(((uint64_t)(u)) >> 48); \
-		(ptr)[2] = (uint8_t)(((uint64_t)(u)) >> 40); \
-		(ptr)[3] = (uint8_t)(((uint64_t)(u)) >> 32); \
-		(ptr)[4] = (uint8_t)(((uint64_t)(u)) >> 24); \
-		(ptr)[5] = (uint8_t)(((uint64_t)(u)) >> 16); \
-		(ptr)[6] = (uint8_t)(((uint64_t)(u)) >> 8);  \
-		(ptr)[7] = (uint8_t)((uint64_t)(u));         \
+#define NNI_PUT64(ptr, u)                                     \
+	do {                                                  \
+		(ptr)[0] = (uint8_t)(((uint64_t)(u)) >> 56u); \
+		(ptr)[1] = (uint8_t)(((uint64_t)(u)) >> 48u); \
+		(ptr)[2] = (uint8_t)(((uint64_t)(u)) >> 40u); \
+		(ptr)[3] = (uint8_t)(((uint64_t)(u)) >> 32u); \
+		(ptr)[4] = (uint8_t)(((uint64_t)(u)) >> 24u); \
+		(ptr)[5] = (uint8_t)(((uint64_t)(u)) >> 16u); \
+		(ptr)[6] = (uint8_t)(((uint64_t)(u)) >> 8u);  \
+		(ptr)[7] = (uint8_t)((uint64_t)(u));          \
 	} while (0)
 
-#define NNI_GET16(ptr, v)                            \
-	v = (((uint16_t)((uint8_t)(ptr)[0])) << 8) + \
+#define NNI_GET16(ptr, v)                             \
+	v = (((uint16_t)((uint8_t)(ptr)[0])) << 8u) + \
 	    (((uint16_t)(uint8_t)(ptr)[1]))
 
-#define NNI_GET32(ptr, v)                             \
-	v = (((uint32_t)((uint8_t)(ptr)[0])) << 24) + \
-	    (((uint32_t)((uint8_t)(ptr)[1])) << 16) + \
-	    (((uint32_t)((uint8_t)(ptr)[2])) << 8) +  \
+#define NNI_GET32(ptr, v)                              \
+	v = (((uint32_t)((uint8_t)(ptr)[0])) << 24u) + \
+	    (((uint32_t)((uint8_t)(ptr)[1])) << 16u) + \
+	    (((uint32_t)((uint8_t)(ptr)[2])) << 8u) +  \
 	    (((uint32_t)(uint8_t)(ptr)[3]))
 
-#define NNI_GET64(ptr, v)                             \
-	v = (((uint64_t)((uint8_t)(ptr)[0])) << 56) + \
-	    (((uint64_t)((uint8_t)(ptr)[1])) << 48) + \
-	    (((uint64_t)((uint8_t)(ptr)[2])) << 40) + \
-	    (((uint64_t)((uint8_t)(ptr)[3])) << 32) + \
-	    (((uint64_t)((uint8_t)(ptr)[4])) << 24) + \
-	    (((uint64_t)((uint8_t)(ptr)[5])) << 16) + \
-	    (((uint64_t)((uint8_t)(ptr)[6])) << 8) +  \
+#define NNI_GET64(ptr, v)                              \
+	v = (((uint64_t)((uint8_t)(ptr)[0])) << 56u) + \
+	    (((uint64_t)((uint8_t)(ptr)[1])) << 48u) + \
+	    (((uint64_t)((uint8_t)(ptr)[2])) << 40u) + \
+	    (((uint64_t)((uint8_t)(ptr)[3])) << 32u) + \
+	    (((uint64_t)((uint8_t)(ptr)[4])) << 24u) + \
+	    (((uint64_t)((uint8_t)(ptr)[5])) << 16u) + \
+	    (((uint64_t)((uint8_t)(ptr)[6])) << 8u) +  \
 	    (((uint64_t)(uint8_t)(ptr)[7]))
 
 // This increments a pointer a fixed number of byte cells.
diff --git a/src/core/dialer.c b/src/core/dialer.c
index 8a463452..fe9cb92f 100644
--- a/src/core/dialer.c
+++ b/src/core/dialer.c
@@ -1,5 +1,5 @@
 //
-// Copyright 2019 Staysail Systems, Inc. <info@staysail.tech>
+// Copyright 2020 Staysail Systems, Inc. <info@staysail.tech>
 // Copyright 2018 Capitar IT Group BV <info@capitar.com>
 // Copyright 2018 Devolutions <info@devolutions.net>
 //
@@ -345,10 +345,12 @@ dialer_connect_cb(void *arg)
 		break;
 	case NNG_ECLOSED:   // No further action.
 	case NNG_ECANCELED: // No further action.
+		nni_dialer_bump_error(d, rv);
 		break;
 	case NNG_ECONNREFUSED:
 	case NNG_ETIMEDOUT:
 	default:
+		nni_dialer_bump_error(d, rv);
 		if (user_aio == NULL) {
 			nni_dialer_timer_start(d);
 		} else {
diff --git a/src/core/listener.c b/src/core/listener.c
index 87d2c532..1fde6e36 100644
--- a/src/core/listener.c
+++ b/src/core/listener.c
@@ -324,8 +324,9 @@ listener_accept_cb(void *arg)
 {
 	nni_listener *l   = arg;
 	nni_aio *     aio = l->l_acc_aio;
+	int rv;
 
-	switch (nni_aio_result(aio)) {
+	switch ((rv = nni_aio_result(aio))) {
 	case 0:
 		BUMP_STAT(&l->l_stats.s_accept);
 		nni_listener_add_pipe(l, nni_aio_get_output(aio, 0));
@@ -335,10 +336,12 @@ listener_accept_cb(void *arg)
 	case NNG_ECONNRESET:   // remote condition, no cool down
 	case NNG_ETIMEDOUT:    // No need to sleep, we timed out already.
 	case NNG_EPEERAUTH:    // peer validation failure
+		nni_listener_bump_error(l, rv);
 		listener_accept_start(l);
 		break;
 	case NNG_ECLOSED:   // no further action
 	case NNG_ECANCELED: // no further action
+		nni_listener_bump_error(l, rv);
 		break;
 	default:
 		// We don't really know why we failed, but we back off
@@ -346,6 +349,7 @@ listener_accept_cb(void *arg)
 		// to system failures (resource exhaustion) and we hope
 		// by not thrashing we give the system a chance to
 		// recover.  100 ms is enough to cool down.
+		nni_listener_bump_error(l, rv);
 		nni_sleep_aio(100, l->l_tmo_aio);
 		break;
 	}
@@ -371,6 +375,7 @@ nni_listener_start(nni_listener *l, int flags)
 	}
 
 	if ((rv = l->l_ops.l_bind(l->l_data)) != 0) {
+		nni_listener_bump_error(l, rv);
 		nni_atomic_flag_reset(&l->l_started);
 		return (rv);
 	}