Skip to content

Commit 722f989

Browse files
author
Sebastien Pouliot
committed
Fix access to freed members of a dead thread
* threads.c: Fix access to freed members of a dead thread. Found and fixed by Rodrigo Kumpera <rkumpera@novell.com> Ref: CVE-2011-0992
1 parent 7d23d76 commit 722f989

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

Diff for: mono/metadata/threads.c

+8-3
Original file line numberDiff line numberDiff line change
@@ -1036,12 +1036,17 @@ void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna
10361036
CloseHandle (thread);
10371037

10381038
if (this->synch_cs) {
1039-
DeleteCriticalSection (this->synch_cs);
1040-
g_free (this->synch_cs);
1039+
CRITICAL_SECTION *synch_cs = this->synch_cs;
10411040
this->synch_cs = NULL;
1041+
DeleteCriticalSection (synch_cs);
1042+
g_free (synch_cs);
10421043
}
10431044

1044-
g_free (this->name);
1045+
if (this->name) {
1046+
void *name = this->name;
1047+
this->name = NULL;
1048+
g_free (name);
1049+
}
10451050
}
10461051

10471052
static void mono_thread_start (MonoThread *thread)

0 commit comments

Comments
 (0)