From db179db57b5f7c8c857f92181e5677c1a212fc10 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Fri, 19 Sep 2025 13:17:04 -0400 Subject: [PATCH] kernel/events: Fix double-free in create_select_sync. The wait_for_objects_sync destructor already deletes the set. Fixes #19566. --- src/system/kernel/events/wait_for_objects.cpp | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/src/system/kernel/events/wait_for_objects.cpp b/src/system/kernel/events/wait_for_objects.cpp index 3fc0fa3484..bc7915af3c 100644 --- a/src/system/kernel/events/wait_for_objects.cpp +++ b/src/system/kernel/events/wait_for_objects.cpp @@ -363,34 +363,27 @@ fd_zero(fd_set *set, int numFDs) static status_t create_select_sync(int numFDs, wait_for_objects_sync*& _sync) { - // create sync structure wait_for_objects_sync* sync = new(nothrow) wait_for_objects_sync; if (sync == NULL) return B_NO_MEMORY; ObjectDeleter syncDeleter(sync); - // create info set sync->set = new(nothrow) select_info[numFDs]; if (sync->set == NULL) return B_NO_MEMORY; - ArrayDeleter setDeleter(sync->set); + sync->count = numFDs; - // create select event semaphore sync->sem = create_sem(0, "select"); if (sync->sem < 0) return sync->sem; - sync->count = numFDs; - for (int i = 0; i < numFDs; i++) { sync->set[i].next = NULL; sync->set[i].sync = sync; } - setDeleter.Detach(); syncDeleter.Detach(); _sync = sync; - return B_OK; }