diff options
| author | Garrett D'Amore <garrett@damore.org> | 2017-08-11 12:15:29 -0700 |
|---|---|---|
| committer | Garrett D'Amore <garrett@damore.org> | 2017-08-11 12:15:29 -0700 |
| commit | ce459d0c55c974e3792adea5e6455a554dc686f9 (patch) | |
| tree | d6582e1f0c67f62e481a0ea82cc5cd4b446f1419 /src/platform | |
| parent | 77cf6e2d9d0d81694bbe1233b0ba27748fae642f (diff) | |
| download | nng-ce459d0c55c974e3792adea5e6455a554dc686f9.tar.gz nng-ce459d0c55c974e3792adea5e6455a554dc686f9.tar.bz2 nng-ce459d0c55c974e3792adea5e6455a554dc686f9.zip | |
Posix pollq fini is not properly idempotent.
This creates a use-after-free bug if nni_fini() is run, then new
sockets are created.
Diffstat (limited to 'src/platform')
| -rw-r--r-- | src/platform/posix/posix_pollq_poll.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/platform/posix/posix_pollq_poll.c b/src/platform/posix/posix_pollq_poll.c index 8f7aece5..d3fdf394 100644 --- a/src/platform/posix/posix_pollq_poll.c +++ b/src/platform/posix/posix_pollq_poll.c @@ -315,7 +315,6 @@ nni_posix_pollq_fini(nni_posix_pollq *pq) nni_plat_pipe_raise(pq->wakewfd); nni_mtx_unlock(&pq->mtx); } - nni_thr_fini(&pq->thr); // All pipes should have been closed before this is called. @@ -330,6 +329,8 @@ nni_posix_pollq_fini(nni_posix_pollq *pq) } if (pq->nfds != 0) { NNI_FREE_STRUCTS(pq->fds, pq->nfds); + pq->fds = NULL; + pq->nfds = 0; } nni_mtx_fini(&pq->mtx); } |