i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WeakReferenceable: Clear fUseCount when it is 1.

Browse Source 
Otherwise, if there are remaining weak references, they could
potentially try to acquire the object and trigger a use-after-free.
This commit is contained in:
Augustin Cavalier
2023-01-31 22:36:59 -05:00
parent b956691cdd
commit 5d41cee816
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
headers/private/shared/WeakReferenceable.h
+2
View File
@@ -30,6 +30,8 @@ public:
void GetUnchecked(); void GetUnchecked();
private: private:
friend class BWeakReferenceable;
int32 fUseCount; int32 fUseCount;
BWeakReferenceable* fObject; BWeakReferenceable* fObject;
}; };
src/kits/shared/WeakReferenceable.cpp
+4 -1
View File
@@ -79,7 +79,10 @@ BWeakReferenceable::BWeakReferenceable()
BWeakReferenceable::~BWeakReferenceable() BWeakReferenceable::~BWeakReferenceable()
{ {
if (fPointer->UseCount() != 0 && fPointer->UseCount() != 1) { if (fPointer->UseCount() == 1)
atomic_test_and_set(&fPointer->fUseCount, 0, 1);
if (fPointer->UseCount() != 0) {
char message[256]; char message[256];
snprintf(message, sizeof(message), "deleting referenceable object %p with " snprintf(message, sizeof(message), "deleting referenceable object %p with "
"reference count (%" B_PRId32 ")", this, fPointer->UseCount()); "reference count (%" B_PRId32 ")", this, fPointer->UseCount());