|
 |
2f8e3d9 |
From 493c4210168fa475aa4130c12e8fdff3b7d85c09 Mon Sep 17 00:00:00 2001
|
|
|
2f8e3d9 |
From: Philippe Canal <pcanal@fnal.gov>
|
|
|
2f8e3d9 |
Date: Mon, 7 Mar 2022 13:32:37 -0600
|
|
|
2f8e3d9 |
Subject: [PATCH] threadsh1: Avoid heap-use-after-free.
|
|
|
2f8e3d9 |
|
|
|
2f8e3d9 |
Previously, the Canvas `Close` signal which triggers a call to the local function `close` which
|
|
|
2f8e3d9 |
was unconditionally call `Kill` on its associated thread would call it on an already deleted
|
|
|
2f8e3d9 |
object if the `TThread` was deleted before the `TCanvas`.
|
|
|
2f8e3d9 |
|
|
|
2f8e3d9 |
This fix #10015 (detected by using ASAN).
|
|
|
2f8e3d9 |
---
|
|
|
2f8e3d9 |
tutorials/legacy/thread/threadsh1.C | 13 +++++++------
|
|
|
2f8e3d9 |
1 file changed, 7 insertions(+), 6 deletions(-)
|
|
|
2f8e3d9 |
|
|
|
2f8e3d9 |
diff --git a/tutorials/legacy/thread/threadsh1.C b/tutorials/legacy/thread/threadsh1.C
|
|
|
2f8e3d9 |
index b819f5d020..d6abc67e36 100644
|
|
|
2f8e3d9 |
--- a/tutorials/legacy/thread/threadsh1.C
|
|
|
2f8e3d9 |
+++ b/tutorials/legacy/thread/threadsh1.C
|
|
|
2f8e3d9 |
@@ -67,7 +67,8 @@ void *joiner(void *)
|
|
|
2f8e3d9 |
void closed(Int_t id)
|
|
|
2f8e3d9 |
{
|
|
|
2f8e3d9 |
// kill the thread matching the canvas being closed
|
|
|
2f8e3d9 |
- t[id]->Kill();
|
|
|
2f8e3d9 |
+ if (t[id])
|
|
|
2f8e3d9 |
+ t[id]->Kill();
|
|
|
2f8e3d9 |
// and set the canvas pointer to 0
|
|
|
2f8e3d9 |
c[id] = 0;
|
|
|
2f8e3d9 |
}
|
|
|
2f8e3d9 |
@@ -142,11 +143,11 @@ void threadsh1()
|
|
|
2f8e3d9 |
t[4]->Join();
|
|
|
2f8e3d9 |
TThread::Ps();
|
|
|
2f8e3d9 |
|
|
|
2f8e3d9 |
- delete t[0];
|
|
|
2f8e3d9 |
- delete t[1];
|
|
|
2f8e3d9 |
- delete t[2];
|
|
|
2f8e3d9 |
- delete t[3];
|
|
|
2f8e3d9 |
- delete t[4];
|
|
|
2f8e3d9 |
+ delete t[0]; t[0] = nullptr; // Prevents after deletion access.
|
|
|
2f8e3d9 |
+ delete t[1]; t[1] = nullptr;
|
|
|
2f8e3d9 |
+ delete t[2]; t[2] = nullptr;
|
|
|
2f8e3d9 |
+ delete t[3]; t[3] = nullptr;
|
|
|
2f8e3d9 |
+ delete t[4]; t[4] = nullptr;
|
|
|
2f8e3d9 |
|
|
|
2f8e3d9 |
delete rng[0];
|
|
|
2f8e3d9 |
delete rng[1];
|
|
|
2f8e3d9 |
--
|
|
|
2f8e3d9 |
2.35.1
|
|
|
2f8e3d9 |
|