Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[vm/ffi] Pointer.asTypedList shared across isolates causes use after free #55800

Open
dcharkes opened this issue May 21, 2024 · 0 comments
Open
Assignees
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. library-ffi triaged Issue has been triaged by sub team

Comments

@dcharkes
Copy link
Contributor

The native finalizers in asTypedList are bound to an isolate, not an isolate group:

sdk/sdk/lib/ffi/ffi.dart

Lines 368 to 373 in 4dd6ee6

external Int8List asTypedList(
int length, {
@Since('3.1') Pointer<NativeFinalizerFunction>? finalizer,
@Since('3.1') Pointer<Void>? token,
});
}

final _asTypedListFinalizer = _NativeFinalizer(_asTypedListFinalizerCallback);

Hypothesis: The TypedData we create out of Pointer is marked unmodifiable.

We need to either mark the typed data as mutable so that the view does not consider the typed data as unmodifiable, and we copy instead of share the object.
Or, we need to attach finalizers in the isolate group instead of the isolate.

Context:

TODO: verify hypothesis. (Filing issue so that I don't forget.)

@dcharkes dcharkes added area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. library-ffi labels May 21, 2024
@dcharkes dcharkes self-assigned this May 21, 2024
@dcharkes dcharkes changed the title [ffi] Pointer.asTypedList shared across isolates causes use after free [vm/ffi] Pointer.asTypedList shared across isolates causes use after free May 21, 2024
@a-siva a-siva added the triaged Issue has been triaged by sub team label May 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. library-ffi triaged Issue has been triaged by sub team
Projects
None yet
Development

No branches or pull requests

2 participants