forked from rsmmr/hilti
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[libhilti] Fix use-after-free on container timers
On map/set/list/vector entry insertion, a timer is created and its ref_cnt = 1 but after the GC_DTOR, the timer is unreferenced and ref_cnt = 0 When a safepoint is done, __hlt_memory_nullbuffer_flush is executed and a free is done on the timer address whereas it does not necessary expire yet. Then when the timer expires, it manipule a pointer that contains bad value (used by another malloc of the program) that produce unexcepted behaviour (segfault). I removed the DC_DTOR, it should be unreferenced only after its expiration and it is the case in the __hlt_timer_fire function. TODO: check if timers are well deleted on container clear or when a entry is deleted.
- Loading branch information
1 parent
5cf9395
commit a6f7434
Showing
3 changed files
with
0 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters