Move TCPSession lifetime to shared_ptr ownership, fix the whole double-delete/UAF class of crash

Every crash root-caused earlier tonight (Subscription::subscribers,
TCPServer::sessions, the Socket::write()/eventReceived() re-arm race) was
the same underlying shape: some thread calling a method - or Thread::run()
calling delete - on a TCPSession* while another thread concurrently freed
that same object, because nothing actually guaranteed the object stayed
alive for the duration of a call. Mutex-based patches at each individual
call site kept narrowing the window without closing it (confirmed live,
repeatedly, via AddressSanitizer under concurrent load - each fix produced
a new, different crash signature at the same underlying race), and adding
more locks around every write() call also works against the fifo-based
design's own goal: no thread should have to block just to hand a message
to another thread's session.

TCPSession now derives from std::enable_shared_from_this<TCPSession> and
exposes pin() - a safe upgrade from a stored raw pointer to a real,
ownership-extending shared_ptr, returning nullptr instead of throwing once
the object's real owner has let go. TCPServer::sessions is now the one
real strong-owning shared_ptr<TCPSession> per live session; every other
place that stores a TCPSession* (Subscription::subscribers, Zephora's own
sessionsByPlayerName, GroupObject's membership list, etc.) is just a
non-owning observer and must pin() before touching the object.

A second, distinct problem: Thread::run()'s epoll dispatch starts from a
raw void* of unknown validity. An early version of this fix used
dynamic_cast<TCPSession*> to identify session objects before calling
pin() - confirmed live via AddressSanitizer that dynamic_cast itself
segfaults on a stale pointer, since it has to read the (potentially freed)
object's own vtable to work at all. TCPSession::tryGet()/TCPServer::
isKnownListeningSocket() replace that: both look the raw pointer up as a
key in a registry, never dereferencing it for the check itself - safe to
call on any value, live session, immortal listening socket, or fully
freed garbage alike.

Verified via an AddressSanitizer-instrumented build under sustained
concurrent load (up to 15-way parallel connect/subscribe/create/disconnect
cycles, multiple rounds, 100+ total connections) with zero errors, then
against the real production build with a genuine 500-connection load test
(463/500 succeeded; the rest hit the process's own file-descriptor
ulimit under peak burst, an unrelated and separately deferred tuning
matter, not a crash).

Files touched: TCPSession.h (enable_shared_from_this, pin(), the tryGet()
registry), TCPServer.h/.cpp (sessions as shared_ptr, isKnownListening
Socket() registry, lock made protected for subclasses), Thread.cpp (the
whole dispatch rewrite), Subscription.cpp/SubscriptionManager.cpp (every
subscriber write() site now pin()s first), ConsoleServer.cpp (logSend()
was iterating `sessions` with no lock at all - fixed alongside the type
change it needed anyway).

TCPServer.cpp

@@ -32,6 +32,14 @@ namespace core {
 	
 	if (listen(getDescriptor(), 20) < 0)
 	  throw coreutils::Exception("Error on listen to socket");
+
+	// See isKnownListeningSocket()'s own doc comment - registers this
+	// listening socket as safe for Thread::run() to dispatch to
+	// directly, distinct from the shared_ptr-owned TCPSession registry.
+	{
+	   std::lock_guard<std::mutex> guard(listeningSocketsMutex());
+	   listeningSockets().insert(this);
+	}
      }
       
    TCPServer::~TCPServer() {
@@ -43,8 +51,20 @@ namespace core {
       coreutils::Log(coreutils::LOG_DEBUG_2) << "Connection request is being received on socket " << getDescriptor() << ".";
       lock.lock();
       TCPSession *session = accept();
-      if (session)
-         sessions.push_back(session);
+      // The shared_ptr constructed here IS the session's real, strong
+      // ownership from now on (see sessions' own doc comment). A second
+      // reference to the SAME shared_ptr (never a second, independent
+      // std::shared_ptr<TCPSession>(session) call on the same raw
+      // pointer - that would create a second, competing control block
+      // and a guaranteed double-free) also goes into the tryGet()
+      // registry, which is what Thread::run()'s epoll dispatch actually
+      // uses to safely reach this object (see TCPSession::tryGet()'s
+      // own comment on why).
+      if (session) {
+         auto sessionPtr = std::shared_ptr<TCPSession>(session);
+         sessions.push_back(sessionPtr);
+         TCPSession::registerLive(session, sessionPtr);
+      }
       // Must run ON THE SESSION, not `this` (the listening server) - the
       // unqualified registerSocket()/acceptSocket() calls this replaced
       // built the SSL* handshake state on the SERVER's own TLS-base
@@ -97,15 +117,32 @@ namespace core {
    }
    
    void TCPServer::removeFromSessionList(TCPSession *session) {
-      std::vector<TCPSession *>::iterator cursor;
       lock.lock();
-      for (cursor = sessions.begin(); cursor < sessions.end(); ++cursor)
-         if (*cursor == session)
+      for (auto cursor = sessions.begin(); cursor < sessions.end(); ++cursor)
+         if (cursor->get() == session)
          {
+            // Drops the one strong-owning reference. If nothing else is
+            // currently pin()'d to this session, the object is actually
+            // destroyed right here, synchronously - same timing as
+            // before this change for the common (no-contention) case.
+            // If some other thread IS mid-call via its own pin()'d
+            // shared_ptr right now, destruction is safely deferred until
+            // that reference is released too, instead of the crash
+            // (double-delete / use-after-free, confirmed live via
+            // AddressSanitizer under concurrent load) that raw-pointer
+            // ownership produced here before.
             sessions.erase(cursor);
             break;
          }
       lock.unlock();
+      // Removes this pointer from the tryGet() lookup registry too (see
+      // TCPSession::tryGet()'s own comment). Safe to do after releasing
+      // `lock` and regardless of whether the erase() above was actually
+      // the last reference: tryGet() correctly reports "gone" the moment
+      // a session's real refcount hits zero, via the weak_ptr's own
+      // expiration - this call is just tidying the registry map itself,
+      // not something later correctness depends on.
+      TCPSession::unregisterLive(session);
    }
    
    void TCPServer::sessionErrorHandler(std::string errorString, std::stringstream &out) {
@@ -139,7 +176,7 @@ namespace core {
       // subscriber list this session's earlier fix addressed.
       std::lock_guard<std::mutex> guard(lock);
       int sequence = 0;
-      for (auto *sessionx : sessions)
+      for (auto &sessionx : sessions)
       {
          session.out << "|" << ++sequence;
          sessionx->output(session.out);
@@ -150,35 +187,35 @@ namespace core {
 
    void TCPServer::sendToAll(std::stringstream &data) {
       std::lock_guard<std::mutex> guard(lock);
-      for (auto session : sessions)
+      for (auto &session : sessions)
 	session->write(data.str());
       data.str("");
    }
 
    void TCPServer::sendToAll(std::stringstream &data, TCPSession &sender) {
       std::lock_guard<std::mutex> guard(lock);
-      for (auto session : sessions)
-         if (session != &sender)
+      for (auto &session : sessions)
+         if (session.get() != &sender)
             session->write(data.str());
       data.str("");
    }
 
    void TCPServer::sendToAll(std::stringstream &data, TCPSession &sender, SessionFilter filter) {
       std::lock_guard<std::mutex> guard(lock);
-      for (auto session : sessions)
+      for (auto &session : sessions)
          if (filter.test(*session))
-            if (session != &sender)
+            if (session.get() != &sender)
                session->write(data.str());
       data.str("");
    }
 
-   TCPSession *TCPServer::getSessionByAlias(void *alias) {
+   std::shared_ptr<TCPSession> TCPServer::getSessionByAlias(void *alias) {
       coreutils::Log(coreutils::LOG_DEBUG_1) << alias;
       std::lock_guard<std::mutex> guard(lock);
-      for (auto session : sessions)
+      for (auto &session : sessions)
 	if (session->alias == alias)
 	  return session;
-      return NULL;
+      return nullptr;
    }
 
 }