summaryrefslogtreecommitdiff
path: root/cppuhelper
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2016-06-17 21:58:09 +0200
committerMichael Stahl <mstahl@redhat.com>2016-06-17 22:13:24 +0200
commit131e604073f89e6c1dd54be88b94b7befd881f2e (patch)
treed382dd311ba08be6bfe8e9cd49cb0614d9ac9d7a /cppuhelper
parentbb1e59d596ffa29d40b4538e18a08e5e91d469a9 (diff)
cppuhelper: fix use-after-free race in OWeakConnectionPoint
OWeakObject::m_pWeakConnectionPoint is returned from OWeakObject::queryAdapter(), and stored in OWeakRefListener::m_xWeakConnectionPoint. This is cleared in OWeakRefListener::dispose(), called from OWeakConnectionPoint::dispose(), called from OWeakObject::disposeWeakConnectionPoint(), but it can happen that another thread is in WeakReferenceHelper::get() and has copied m_xWeakConnectionPoint onto the stack before the OWeakObject is released and deleted, then calls OWeakConnectionPoint::queryAdapted() after it is released, accessing the dead m_pObject. Change-Id: I7782e6fb7e07f5a48cf7064115217376714ba8e8
Diffstat (limited to 'cppuhelper')
-rw-r--r--cppuhelper/source/weak.cxx3
1 files changed, 3 insertions, 0 deletions
diff --git a/cppuhelper/source/weak.cxx b/cppuhelper/source/weak.cxx
index ed1f77208249..85cf3f626482 100644
--- a/cppuhelper/source/weak.cxx
+++ b/cppuhelper/source/weak.cxx
@@ -111,6 +111,9 @@ void SAL_CALL OWeakConnectionPoint::dispose() throw(css::uno::RuntimeException)
std::vector<Reference<XReference>> aCopy;
{ // only hold the mutex while we access the field
MutexGuard aGuard(getWeakMutex());
+ // OWeakObject is not the only owner of this, so clear m_pObject
+ // so that queryAdapted() won't use it now that it's dead
+ m_pObject = nullptr;
// other code is going to call removeReference while we are doing this, so we need a
// copy, but since we are disposing and going away, we can just take the original data
aCopy.swap(m_aReferences);