diff options
| author | Michael Stahl <mstahl@redhat.com> | 2016-06-17 21:58:09 +0200 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2016-06-26 14:01:50 +0200 |
| commit | 88d6e219b7ab2df99966f44549966deff75c703c (patch) | |
| tree | 218b63479b21269a3b0247756d022f8bc0c9176f /cppuhelper | |
| parent | 2216e720d10bf3dce656d955762f02cca7d3f98e (diff) | |
cppuhelper: fix use-after-free race in OWeakConnectionPoint
OWeakObject::m_pWeakConnectionPoint is returned from
OWeakObject::queryAdapter(), and stored in
OWeakRefListener::m_xWeakConnectionPoint.
This is cleared in OWeakRefListener::dispose(), called from
OWeakConnectionPoint::dispose(), called from
OWeakObject::disposeWeakConnectionPoint(), but it can happen that
another thread is in WeakReferenceHelper::get() and has copied
m_xWeakConnectionPoint onto the stack before the OWeakObject is
released and deleted, then calls OWeakConnectionPoint::queryAdapted()
after it is released, accessing the dead m_pObject.
(cherry picked from commit 131e604073f89e6c1dd54be88b94b7befd881f2e)
Change-Id: I7782e6fb7e07f5a48cf7064115217376714ba8e8
Reviewed-on: https://gerrit.libreoffice.org/26441
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
(cherry picked from commit 72cd79fa1ff3e385eec5a2aed380aa9a776d1a07)
Diffstat (limited to 'cppuhelper')
| -rw-r--r-- | cppuhelper/source/weak.cxx | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/cppuhelper/source/weak.cxx b/cppuhelper/source/weak.cxx index 72b88969715d..82e279e82c2a 100644 --- a/cppuhelper/source/weak.cxx +++ b/cppuhelper/source/weak.cxx @@ -105,6 +105,12 @@ void SAL_CALL OWeakConnectionPoint::release() throw() void SAL_CALL OWeakConnectionPoint::dispose() throw(css::uno::RuntimeException) { + { + MutexGuard aGuard(getWeakMutex()); + // OWeakObject is not the only owner of this, so clear m_pObject + // so that queryAdapted() won't use it now that it's dead + m_pObject = nullptr; + } Any ex; OInterfaceIteratorHelper aIt( m_aReferences ); while( aIt.hasMoreElements() ) |