[boost] [asio]ssl::detail::stream_core is accessed after destruction

Hello, I'm using Boost.Asio. I compiled some TLS client with clang address sanitizer. (I attached the result the last part of this mail.) It indicates that the following `expires_at` member function calling is bad: https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/de... So I insert debug print "stream_core() address" to the constructor of ssl::detail::stream_core https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/de... "~stream_core() address" to the destructor, https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/de... and "io stream_core address of core_" to `expires_at` calling point: https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/de... And then, I got the following result: stream_core() 0x6120012beb60 constructor ~stream_core() 0x6120012ca6e0 connected. previous session = false stream_core() 0x6120012ba060 ~stream_core() 0x6120012beb60 destructor io stream_core 0x6120012beb60 call Is seems that `expires_at` at https://github.com/boostorg/asio/blob/boost-1.63.0/include/boost/asio/ssl/de... is called after core_ 's destructor is called. The problem happens a part of big project. The client connects to the server as TLS-stream, then server shutdown the stream, then client connects again. The program does the sequence repeatedly. The error happens the client side. I'm trying to write a minimal and complete code that reproduces the problem, but not yet. So I report the result only as the first report. The result of clang address sanitizer ---------------------------------------------------------------------------------- SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/boost/asio/basic_deadline_timer.hpp:344:27 in boost::asio::basic_deadline_timerboost::posix_time::ptime, boost::asio::deadline_timer_serviceboost::posix_time::ptime >

::expires_at(boost::posix_time::ptime const&) Shadow bytes around the buggy address: 0x0c248024fd20: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x0c248024fd30: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c248024fd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c248024fd50: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x0c248024fd60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c248024fd70: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd 0x0c248024fd80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c248024fd90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c248024fda0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c248024fdb0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x0c248024fdc0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==11437==ABORTING

---------------------------------------------------------------------------------- heap use after free occurs the following code: ---------------------------------------------------------------------------------- ==11437==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120012bebb0 at pc 0x000000749b30 bp 0x7ffccc310470 sp 0x7ffccc310468 READ of size 8 at 0x6120012bebb0 thread T0 #0 0x749b2f in boost::asio::basic_deadline_timerboost::posix_time::ptime, boost::asio::deadline_timer_serviceboost::posix_time::ptime >

::expires_at(boost::posix_time::ptime const&) /usr/include/boost/asio/basic_deadline_timer.hpp:344:27 #1 0x748e21 in boost::asio::ssl::detail::io_opboost::asio::ip::tcp >, boost::asio::ssl::detail::write_opboost::asio::mutable_buffers_1, boost::asio::detail::write_opboost::asio::ip::tcp > >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t, boost::asio::detail::wrapped_handlerboost::asio::ip::tcp > >, boost::asio::io_service::strand, std::mutex, std::lock_guard>::write_completion_handler, boost::asio::detail::is_continuation_if_running> > ::operator()(boost::system::error_code, unsigned long, int) /usr/include/boost/asio/ssl/detail/io.hpp:260:32 #2 0x7590e7 in boost::asio::detail::write_opboost::asio::ip::tcp >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t, boost::asio::ssl::detail::io_opboost::asio::ip::tcp ,boost::asio::ssl::detail::write_opboost::asio::mutable_buffers_1, boost::asio::detail::write_opboost::asio::ip::tcp > >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_all_t, boost::asio::detail::wrapped_handlerboost::asio::ip::tcp > >, boost::asio::io_service::strand, std::mutex, std::lock_guard>::write_completion_handler, boost::asio::detail::is_continuation_if_running> > > ::operator()(boost::system::error_code const&, unsigned long, int) /usr/include/boost/asio/impl/write.hpp:269:9

Thanks, Takatoshi Kondo