Fix Use after heep free issue

Do not read the unitmap after destroying the parcel.

Change-Id: I26c9bf4d35c845c6e3bd9d44086d3452a6eac1cf
Signed-off-by: Changgyu Choi <changyu.choi@samsung.com>

diff --git a/idlc/gen/version2/c_proxy_body_generator_cb.hh b/idlc/gen/version2/c_proxy_body_generator_cb.hh
index 06e49e2324dcb7419550d6bdc153f5172ddb576b..af49dfd86300e55471c5921b706283b00d822779 100644 (file)
--- a/idlc/gen/version2/c_proxy_body_generator_cb.hh
+++ b/idlc/gen/version2/c_proxy_body_generator_cb.hh
@@ -619,9 +619,8 @@ void <PREFIX>_<NAME>_invoke_<METHOD_NAME>(<PREFIX>_<NAME>_h h<METHOD_PARAMS>)
     if (rpc_port_proxy_lem_is_connected(h->lem)) {
       map_ = rpc_port_unit_map_create();
       rpc_port_parcel_read(result_parcel_, &map_->parcelable, map_);
-      rpc_port_parcel_destroy(result_parcel_);
     } else {
-      __<PREFIX>_<NAME>_consume_command(h->port, seq_num_, &map_);
+      __<PREFIX>_<NAME>_consume_command(h->port, seq_num_, &map_, &result_parcel_);
     }
 
     if (map_ == nullptr) {
@@ -632,6 +631,7 @@ void <PREFIX>_<NAME>_invoke_<METHOD_NAME>(<PREFIX>_<NAME>_h h<METHOD_PARAMS>)
 
     <METHOD_UNIT_MAP_READ>
     rpc_port_unit_map_destroy(map_);
+    rpc_port_parcel_destroy(result_parcel_);
   } while (0);
   g_rec_mutex_unlock(&h->mutex);
   set_last_result(res_);
@@ -1037,7 +1037,6 @@ static void __<PREFIX>_<NAME>_received(const char *endpoint, const char *port_na
   }
 
   rpc_port_parcel_read(parcel, &map->parcelable, map);
-  rpc_port_parcel_destroy(parcel);
 
   rpc_port_unit_map_read_int(map, <HASH_METHOD> /*[METHOD]*/, &cmd);
   if (cmd != <UPPERCASE_PREFIX>_<UPPERCASE_NAME>_METHOD_CALLBACK_) {
@@ -1050,6 +1049,7 @@ static void __<PREFIX>_<NAME>_received(const char *endpoint, const char *port_na
   __<PREFIX>_<NAME>_process_received_event(&h->delegates, map);
   g_rec_mutex_unlock(&h->mutex);
   rpc_port_unit_map_destroy(map);
+  rpc_port_parcel_destroy(parcel);
 }
 )__c_cb";
 
@@ -1077,7 +1077,7 @@ lem_callback.received = __<PREFIX>_<NAME>_lem_received;
  */
 constexpr const char CB_INTERFACE_BASE[] =
 R"__c_cb(
-static void __<PREFIX>_<NAME>_consume_command(rpc_port_h port, int seq_num, rpc_port_unit_map_h *unit_map)
+static void __<PREFIX>_<NAME>_consume_command(rpc_port_h port, int seq_num, rpc_port_unit_map_h *unit_map, rpc_port_parcel_h *received_parcel)
 {
   rpc_port_parcel_h parcel;
   rpc_port_parcel_header_h header;
@@ -1108,7 +1108,6 @@ static void __<PREFIX>_<NAME>_consume_command(rpc_port_h port, int seq_num, rpc_
     }
 
     rpc_port_parcel_read(parcel, &map->parcelable, map);
-    rpc_port_parcel_destroy(parcel);
 
     rpc_port_unit_map_read_int(map, <HASH_METHOD> /*[METHOD]*/, &cmd);
     if (cmd == <UPPERCASE_PREFIX>_<UPPERCASE_NAME>_METHOD_RESULT_) {
@@ -1119,10 +1118,12 @@ static void __<PREFIX>_<NAME>_consume_command(rpc_port_h port, int seq_num, rpc_
       rpc_port_unit_map_read_remote_exception(map, <HASH_REMOTE_EXCEPTION> /*[REMOTE_EXCEPTION]*/, &__<PREFIX>_remote_exception);
 
       *unit_map = map;
+      *received_parcel = parcel;
       return;
     }
 
     rpc_port_unit_map_clear(map);
+    rpc_port_parcel_destroy(parcel);
   } while (true);
 
   rpc_port_unit_map_destroy(map);
@@ -1522,9 +1523,8 @@ R"__c_cb(
     if (rpc_port_proxy_lem_is_connected(h->lem)) {
       map_ = rpc_port_unit_map_create();
       rpc_port_parcel_read(result_parcel_, &map_->parcelable, map_);
-      rpc_port_parcel_destroy(result_parcel_);
     } else {
-      __<PREFIX>_<NAME>_consume_command(h->port, seq_num_, &map_);
+      __<PREFIX>_<NAME>_consume_command(h->port, seq_num_, &map_, &result_parcel_);
     }
 
     if (map_ == nullptr) {
@@ -1535,6 +1535,7 @@ R"__c_cb(
 
     <METHOD_UNIT_MAP_READ>
     rpc_port_unit_map_destroy(map_);
+    rpc_port_parcel_destroy(result_parcel_);
   } while (0);
   g_rec_mutex_unlock(&h->mutex);
   set_last_result(res_);

diff --git a/idlc/gen/version2/cpp_proxy_body_generator_cb.hh b/idlc/gen/version2/cpp_proxy_body_generator_cb.hh
index 5f284e179b490cd8c7ca14696af5efdc574aa6ec..366fc29a07319266c9b8caf64b3e5067b2e9bb54 100644 (file)
--- a/idlc/gen/version2/cpp_proxy_body_generator_cb.hh
+++ b/idlc/gen/version2/cpp_proxy_body_generator_cb.hh
@@ -281,7 +281,7 @@ void <CLS_NAME>::ProcessReceivedEvent(const UnitMap& unit_map) {
   }
 }
 
-void <CLS_NAME>::ConsumeCommand(rpc_port_h port, int seq_num, UnitMap& unit_map) {
+void <CLS_NAME>::ConsumeCommand(rpc_port_h port, int seq_num, UnitMap& unit_map, rpc_port_parcel_h* received_parcel) {
   do {
     rpc_port_parcel_h parcel;
     int ret = rpc_port_parcel_create_from_port(&parcel, port);
@@ -302,14 +302,16 @@ void <CLS_NAME>::ConsumeCommand(rpc_port_h port, int seq_num, UnitMap& unit_map)
     }
 
     unit_map.Deserialize(parcel);
-    rpc_port_parcel_destroy(parcel);
 
     int cmd = -1;
     unit_map.Read(<HASH_METHOD> /*[METHOD]*/, cmd);
-    if (cmd == static_cast<int>(MethodId::__Result))
+    if (cmd == static_cast<int>(MethodId::__Result)) {
+      *received_parcel = parcel;
       return;
+    }
 
     unit_map.Clear();
+    rpc_port_parcel_destroy(parcel);
   } while (true);
 }
 
@@ -347,16 +349,17 @@ void <CLS_NAME>::OnReceivedCb(const char* endpoint, const char* port_name, void*
 
   UnitMap unit_map;
   unit_map.Deserialize(parcel);
-  rpc_port_parcel_destroy(parcel);
 
   int cmd = -1;
   unit_map.Read(<HASH_METHOD> /*[METHOD]*/, cmd);
   if (cmd != static_cast<int>(MethodId::__Callback)) {
     _E("Invalid procotol");
+    rpc_port_parcel_destroy(parcel);
     return;
   }
 
   handle->ProcessReceivedEvent(unit_map);
+  rpc_port_parcel_destroy(parcel);
 }
 )__cpp_cb";
 
@@ -472,9 +475,8 @@ R"__cpp_cb(
   UnitMap received_map_;
   if (local_execution_.get() != nullptr && local_execution_->IsConnected()) {
     received_map_.Deserialize(result_parcel_);
-    rpc_port_parcel_destroy(result_parcel_);
   } else {
-    ConsumeCommand(port_, seq_num_, received_map_);
+    ConsumeCommand(port_, seq_num_, received_map_, &result_parcel_);
   }
 
   if (received_map_.GetSize() == 0) {
@@ -485,6 +487,7 @@ R"__cpp_cb(
   if (unit_ != nullptr) {
     RemoteException remote_except;
     unit_->Read(remote_except);
+    rpc_port_parcel_destroy(result_parcel_);
     throw remote_except;
   }
 
@@ -493,6 +496,7 @@ R"__cpp_cb(
   </DESERIALIZE*>
 
   received_map_.Read(<HASH_RESULT> /*[RESULT]*/, result_);
+  rpc_port_parcel_destroy(result_parcel_);
   return result_;
 }
 )__cpp_cb";

diff --git a/idlc/gen/version2/cpp_proxy_header_generator_cb.hh b/idlc/gen/version2/cpp_proxy_header_generator_cb.hh
index 77c62deda2be4193f6683cc566d95af706e514e3..b62246625cacae0964df5b40658e9b38fb5a9bf0 100644 (file)
--- a/idlc/gen/version2/cpp_proxy_header_generator_cb.hh
+++ b/idlc/gen/version2/cpp_proxy_header_generator_cb.hh
@@ -189,7 +189,7 @@ class <CLS_NAME> : public LocalExecution::IEvent {
   <DELEGATE_IDS>
 
   void ProcessReceivedEvent(const UnitMap& unit_map);
-  void ConsumeCommand(rpc_port_h port, int seq_num, UnitMap& unit_map);
+  void ConsumeCommand(rpc_port_h port, int seq_num, UnitMap& unit_map, rpc_port_parcel_h* received_parcel);
   static void OnConnectedCb(const char* endpoint, const char* port_name, rpc_port_h port, void* user_data);
   static void OnDisconnectedCb(const char* endpoint, const char* port_name, void* user_data);
   static void OnRejectedCb(const char* endpoint, const char* port_name, void* user_data);

diff --git a/idlc/gen/version2/cs_proxy_generator_cb.h b/idlc/gen/version2/cs_proxy_generator_cb.h
index e29d12080859ca47291c1bb0eac620cdba2bd8d9..6a2114214254119f3139dc19d22fe5e87cc11d34 100644 (file)
--- a/idlc/gen/version2/cs_proxy_generator_cb.h
+++ b/idlc/gen/version2/cs_proxy_generator_cb.h
@@ -273,7 +273,7 @@ namespace RPCPort
                     }
                 }
 
-                private void ConsumeCommand(out UnitMap unitMap, Port port, ParcelHeader header)
+                private void ConsumeCommand(out UnitMap unitMap, out Parcel parcelReceived, Port port, ParcelHeader header)
                 {
                     do
                     {
@@ -286,6 +286,7 @@ namespace RPCPort
                         catch (InvalidIOException)
                         {
                             unitMap = null;
+                            parcelReceived = null;
                             return;
                         }
 
@@ -303,6 +304,7 @@ namespace RPCPort
                         map.Deserialize(p);
 
                         unitMap = map;
+                        parcelReceived = p;
                         return;
                     } while (true);
                 }
@@ -487,7 +489,7 @@ namespace RPCPort
                             else
                             {
                                 // Receive
-                                ConsumeCommand(out mapReceived, Port, header);
+                                ConsumeCommand(out mapReceived, out ret_parcel, Port, header);
                             }
 
                             if (mapReceived == null)
@@ -524,4 +526,4 @@ namespace RPCPort
 
 )__cs_cb";
 
-#endif  // IDLC_CS_GEN_VERSION2_CS_PROXY_GENRATOR_CB_H_
\ No newline at end of file
+#endif  // IDLC_CS_GEN_VERSION2_CS_PROXY_GENRATOR_CB_H_

diff --git a/idlc/gen/version2/rs_proxy_gen_cb.h b/idlc/gen/version2/rs_proxy_gen_cb.h
index b1f59ebfd2c64da3eb8ec6edd448ddc5604d446f..5ac259658a62d5cbb3bc2162fdc3b34dccaa7fea 100644 (file)
--- a/idlc/gen/version2/rs_proxy_gen_cb.h
+++ b/idlc/gen/version2/rs_proxy_gen_cb.h
@@ -496,9 +496,10 @@ pub mod <MOD_NAME> {
 
             <SYNC?>
             let mut __map_received = UnitMap::new();
+            let mut __parcel_received = Parcel::from(&__port);
             loop {
-                let __parcel_received = Parcel::from(&__port);
                 if __parcel_received.get_seq_num() != seq_num {
+                    __parcel_received = Parcel::from(&__port);
                     continue;
                 }