Fix heap-use-after-free issue 26/320026/2
authorChanggyu Choi <changyu.choi@samsung.com>
Thu, 7 Nov 2024 01:47:16 +0000 (10:47 +0900)
committerChanggyu Choi <changyu.choi@samsung.com>
Thu, 7 Nov 2024 01:50:04 +0000 (10:50 +0900)
The self of the Task object must be maintained until the thread method scope terminated.

backtrace:
==8012==ERROR: AddressSanitizer: heap-use-after-free on address 0xb3b0a69c at pc 0xb69743b7 bp 0xb2cfeba0 sp 0xb2cfeba4
WRITE of size 4 at 0xb3b0a69c thread T1 (sender)
    #0 0xb69743b4 in operator() /usr/src/debug/tizen-core-0.1.25-0.arm/src/tizen-core/task.cc:250
    #1 0xb69743b4 in __invoke_impl<void, tizen_core::Task::Run()::<lambda()> > /usr/lib/gcc/armv7l-tizen-linux-gnueabi/9.2.0/include/c++/bits/invoke.h:60
    #2 0xb69743b4 in __invoke<tizen_core::Task::Run()::<lambda()> > /usr/lib/gcc/armv7l-tizen-linux-gnueabi/9.2.0/include/c++/bits/invoke.h:95
    #3 0xb69743b4 in _M_invoke<0> /usr/lib/gcc/armv7l-tizen-linux-gnueabi/9.2.0/include/c++/thread:244
    #4 0xb69743b4 in operator() /usr/lib/gcc/armv7l-tizen-linux-gnueabi/9.2.0/include/c++/thread:251
    #5 0xb69743b4 in _M_run /usr/lib/gcc/armv7l-tizen-linux-gnueabi/9.2.0/include/c++/thread:195
    #6 0xb685f512  (/lib/libstdc++.so.6+0xa0512)
    #7 0xb6a37936  (/lib/libasan.so.6+0x33936)
    #8 0xb6607434  (/lib/libpthread.so.0+0x7434)

Change-Id: I723145fefead941ee26e8e317c7bab7ee8b2c983
Signed-off-by: Changgyu Choi <changyu.choi@samsung.com>
src/tizen-core/task.cc

index b6fa04a589caf160347fe9aa3d2176278430bc00..bdba380856cd11eeadc69a53c6b1cccb149067f3 100644 (file)
@@ -245,6 +245,7 @@ void Task::Run() {
     std::unique_lock<std::mutex> lock(loop_mutex_);
     idle_entered_ = false;
     thread_ = std::thread([&]() -> void {
+      auto self = shared_from_this();
       tid_ = gettid();
       ThreadLoop();
       tid_ = -1;
@@ -388,7 +389,6 @@ bool Task::ClearCpuBoosting() {
 
 void Task::ThreadLoop() {
   _D("[%s] BEGIN", name_.c_str());
-  auto self = shared_from_this();
   {
     std::unique_lock<std::mutex> lock(loop_mutex_);
     GSource* source = g_idle_source_new();