Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WeakReferenceable: Clear fUseCount when it is 1.

Browse Source 
Otherwise, if there are remaining weak references, they could
potentially try to acquire the object and trigger a use-after-free.
This commit is contained in:
Augustin Cavalier 2023-01-31 22:36:59 -05:00
parent b956691cdd
commit 5d41cee816
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
headers/private/shared/WeakReferenceable.h
View File

@ -30,6 +30,8 @@ public:
void GetUnchecked();
private:
friend class BWeakReferenceable;
int32 fUseCount;
BWeakReferenceable* fObject;
};

5
src/kits/shared/WeakReferenceable.cpp
View File

@ -79,7 +79,10 @@ BWeakReferenceable::BWeakReferenceable()
BWeakReferenceable::~BWeakReferenceable()
{
if (fPointer->UseCount() != 0 && fPointer->UseCount() != 1) {
if (fPointer->UseCount() == 1)
atomic_test_and_set(&fPointer->fUseCount, 0, 1);
if (fPointer->UseCount() != 0) {
char message[256];
snprintf(message, sizeof(message), "deleting referenceable object %p with "
"reference count (%" B_PRId32 ")", this, fPointer->UseCount());