Skip to content

Commit

Permalink
Fixing Potential Double Free Issue (#517)
Browse files Browse the repository at this point in the history
* Fix Potential Double Free

Co-authored-by: Daniel Henry-Mantilla <daniel.henry.mantilla@gmail.com>
  • Loading branch information
kuzeyardabulut and danielhenrymantilla committed Aug 7, 2023
1 parent 5f40b83 commit cd53ad6
Showing 1 changed file with 6 additions and 7 deletions.
13 changes: 6 additions & 7 deletions notify/src/windows.rs
Original file line number Diff line number Diff line change
Expand Up @@ -278,7 +278,7 @@ fn start_read(rd: &ReadData, event_handler: Arc<Mutex<dyn EventHandler>>, handle
};

unsafe {
let mut overlapped: Box<OVERLAPPED> = Box::new(mem::zeroed());
let mut overlapped = std::mem::ManuallyDrop::new(Box::new(mem::zeroed::<OVERLAPPED>()));
// When using callback based async requests, we are allowed to use the hEvent member
// for our own purposes

Expand All @@ -295,19 +295,18 @@ fn start_read(rd: &ReadData, event_handler: Arc<Mutex<dyn EventHandler>>, handle
monitor_subdir,
flags,
&mut 0u32 as *mut u32, // not used for async reqs
&mut *overlapped as *mut OVERLAPPED,
(&mut **overlapped) as *mut OVERLAPPED,
Some(handle_event),
);

if ret == 0 {
// error reading. retransmute request memory to allow drop.
// allow overlapped to drop by omitting forget()
// Because of the error, ownership of the `overlapped` alloc was not passed
// over to `ReadDirectoryChangesW`.
// So we can claim ownership back.
let _overlapped_alloc = std::mem::ManuallyDrop::into_inner(overlapped);
let request: Box<ReadDirectoryRequest> = mem::transmute(request_p);

ReleaseSemaphore(request.data.complete_sem, 1, ptr::null_mut());
} else {
// read ok. forget overlapped to let the completion routine handle memory
mem::forget(overlapped);
}
}
}
Expand Down

0 comments on commit cd53ad6

Please sign in to comment.