Fix casting bug

terrarier2111 · Jun 5, 2023 · 6cf274c · 6cf274c
1 parent 93f05a2
commit 6cf274c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/lib.rs b/src/lib.rs
@@ -340,7 +340,7 @@ impl<T, M: Metadata, const AUTO_FREE_IDS: bool> Entry<T, M, AUTO_FREE_IDS> {
         self.guard.store(GUARD_EMPTY, Ordering::Release);
         // check if we are a "main" entry and our thread is finished
         let outstanding = self.outstanding_refs.load(Ordering::Acquire);
-        if let Some(outstanding) = unsafe { outstanding.as_ref() } {
+        if let Some(outstanding) = unsafe { outstanding.as_ref() } { // FIXME: this as_ref call leads to a use-after-free
             if outstanding.fetch_sub(1, Ordering::AcqRel) != 1 {
                 // there are outstanding references left, so we can't free the id yet.
                 return;

diff --git a/src/thread_id.rs b/src/thread_id.rs
@@ -130,7 +130,7 @@ impl FreeList {
         let mut outstanding = 0;
         for entry in free_list.unwrap().iter() {
             // sum up all the "failed" cleanups
-            if unsafe { !entry.1.cleanup(*entry.0 as *const Entry<()>, &outstanding_shared as *const Box<AtomicUsize> as *const AtomicUsize) } {
+            if unsafe { !entry.1.cleanup(*entry.0 as *const Entry<()>, outstanding_shared.deref() as *const AtomicUsize) } {
                 outstanding += 1;
             }
         }