AuroraSupport/AuroraRuntime
2
1
Fork 0
Code Issues 27 Pull Requests Releases Wiki Activity

[*] Fix use after free in termination path of heap. cannot safely use try lock in this one single place.

Browse Source
This commit is contained in:
Reece Wilson 2022-12-07 11:38:10 +00:00
parent 1f1d1bbc28
commit 73e77d0a97
2 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Source/AuRTEntrypoint.cpp
View File

@ -28,6 +28,7 @@
#include "Extensions/Win32/DarkTheme.hpp"
#include <timeapi.h>
#endif
#include "Debug/MemoryCrunch.hpp"
#include "Process/Process.hpp"
#include "Exit/AuExit.hpp"
#include "CmdLine/CmdLine.hpp"
@ -114,6 +115,11 @@ static void RuntimeLateClean() // strictly IO flushing + DeinitGrug can sometime
Aurora::Processes::Deinit();
Aurora::Exit::DeinitExit();
Aurora::IO::Deinit();
AuDebug::gReservePoolStart = 0;
AuDebug::gReservePoolEnd = 0;
AuDebug::gReserveHeap.reset();
gRuntimeRunLevel = 5;
}

17
Source/Memory/Heap.cpp
View File

@ -227,7 +227,7 @@ namespace Aurora::Memory
auto ret = o1heapAllocate(this->heap_, length);
if (ret)
{
this->count_++;
AuAtomicAdd(&this->count_, 1);
}
return ret;
}
@ -314,9 +314,8 @@ namespace Aurora::Memory
void InternalHeap::DecrementUsers()
{
if (--this->count_ == 0)
if (AuAtomicSub(&this->count_, 1) == 0)
{
AU_LOCK_GUARD(this->mutex_);
TryRelease();
}
}
@ -336,16 +335,16 @@ namespace Aurora::Memory
void InternalHeap::RequestTermination()
{
AU_LOCK_GUARD(this->mutex_);
if (count_)
this->mutex_->Lock();
if (this->count_)
{
AuLogWarn("Heap life was less than its allocations, waiting for final free");
AuLogWarn("Reporting using mayday!");
SysPushErrorMemory("Heap life was less than its allocations, waiting for final free");
SysPushErrorMemory("Reporting using mayday!");
Telemetry::Mayday();
this->isDangling_ = true;
TryRelease();
this->mutex_->Unlock();
}
else
{