This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

fs: fix use after free in stat watcher

The uv_fs_poll_t handle was stopped but not closed, leaving libuv's internal
handle queue in a corrupted state.
  • Loading branch information...
bnoordhuis committed Aug 20, 2012
1 parent 0844e23 commit b1ffbdc975d58b31e3b13749c29fdc07049ea1d9
Showing with 30 additions and 15 deletions.
  1. +27 −7 src/node_stat_watcher.cc
  2. +3 −8 src/node_stat_watcher.h
View
@@ -49,19 +49,39 @@ void StatWatcher::Initialize(Handle<Object> target) {
}
+static void Delete(uv_handle_t* handle) {
+ delete reinterpret_cast<uv_fs_poll_t*>(handle);
+}
+
+
+StatWatcher::StatWatcher()
+ : ObjectWrap()
+ , watcher_(new uv_fs_poll_t)
+{
+ uv_fs_poll_init(uv_default_loop(), watcher_);
+ watcher_->data = static_cast<void*>(this);
+}
+
+
+StatWatcher::~StatWatcher() {
+ Stop();
+ uv_close(reinterpret_cast<uv_handle_t*>(watcher_), Delete);
+}
+
+
void StatWatcher::Callback(uv_fs_poll_t* handle,
int status,
const uv_statbuf_t* prev,
const uv_statbuf_t* curr) {
- StatWatcher* wrap = container_of(handle, StatWatcher, watcher_);
- assert(handle == &wrap->watcher_);
+ StatWatcher* wrap = static_cast<StatWatcher*>(handle->data);
+ assert(wrap->watcher_ == handle);
HandleScope scope;
Local<Value> argv[3];
argv[0] = BuildStatsObject(curr);
argv[1] = BuildStatsObject(prev);
argv[2] = Integer::New(status);
if (status == -1) {
- SetErrno(uv_last_error(wrap->watcher_.loop));
+ SetErrno(uv_last_error(wrap->watcher_->loop));
}
if (onchange_sym.IsEmpty()) {
onchange_sym = NODE_PSYMBOL("onchange");
@@ -88,8 +108,8 @@ Handle<Value> StatWatcher::Start(const Arguments& args) {
const bool persistent = args[1]->BooleanValue();
const uint32_t interval = args[2]->Uint32Value();
- if (!persistent) uv_unref(reinterpret_cast<uv_handle_t*>(&wrap->watcher_));
- uv_fs_poll_start(&wrap->watcher_, Callback, *path, interval);
+ if (!persistent) uv_unref(reinterpret_cast<uv_handle_t*>(wrap->watcher_));
+ uv_fs_poll_start(wrap->watcher_, Callback, *path, interval);
wrap->Ref();
return Undefined();
@@ -109,8 +129,8 @@ Handle<Value> StatWatcher::Stop(const Arguments& args) {
void StatWatcher::Stop () {
- if (!uv_is_active(reinterpret_cast<uv_handle_t*>(&watcher_))) return;
- uv_fs_poll_stop(&watcher_);
+ if (!uv_is_active(reinterpret_cast<uv_handle_t*>(watcher_))) return;
+ uv_fs_poll_stop(watcher_);
Unref();
}
View
@@ -34,13 +34,8 @@ class StatWatcher : ObjectWrap {
protected:
static v8::Persistent<v8::FunctionTemplate> constructor_template;
- StatWatcher() : ObjectWrap() {
- uv_fs_poll_init(uv_default_loop(), &watcher_);
- }
-
- ~StatWatcher() {
- Stop();
- }
+ StatWatcher();
+ virtual ~StatWatcher();
static v8::Handle<v8::Value> New(const v8::Arguments& args);
static v8::Handle<v8::Value> Start(const v8::Arguments& args);
@@ -53,7 +48,7 @@ class StatWatcher : ObjectWrap {
const uv_statbuf_t* curr);
void Stop();
- uv_fs_poll_t watcher_;
+ uv_fs_poll_t* watcher_;
};
} // namespace node

0 comments on commit b1ffbdc

Please sign in to comment.