mirrors/SDL
1
0
Fork 0
mirror of https://github.com/libsdl-org/SDL.git synced 2026-04-28 10:14:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed double-free during multi-threaded hidapi access

Browse Source 
The error string is not protected by a mutex, and can be set from multiple threads at the same time. Without this change, it can be double-freed. It can still be double-allocated, leading to a memory leak, but at least it won't crash now.

Signed-off-by: Sam Lantinga <slouken@libsdl.org>
This commit is contained in:
Sam Lantinga
2023-05-26 20:28:20 -07:00
parent 860e52c99e
commit 2b386b6c80
4 changed files with 45 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/hidapi/windows/hid.c
View File

@@ -255,8 +255,15 @@ static void free_hid_device(hid_device *dev)
static void register_winapi_error_to_buffer(wchar_t **error_buffer, const WCHAR *op)
{
free(*error_buffer);
*error_buffer = NULL;
wchar_t *old_string;
#ifdef HIDAPI_ATOMIC_SET_POINTER
old_string = HIDAPI_ATOMIC_SET_POINTER(error_buffer, NULL);
#else
old_string = *error_buffer; *error_buffer = NULL;
#endif
if (old_string) {
free(old_string);
}
/* Only clear out error messages if NULL is passed into op */
if (!op) {
@@ -320,8 +327,15 @@ static void register_winapi_error_to_buffer(wchar_t **error_buffer, const WCHAR
static void register_string_error_to_buffer(wchar_t **error_buffer, const WCHAR *string_error)
{
free(*error_buffer);
*error_buffer = NULL;
wchar_t *old_string;
#ifdef HIDAPI_ATOMIC_SET_POINTER
old_string = HIDAPI_ATOMIC_SET_POINTER(error_buffer, NULL);
#else
old_string = *error_buffer; *error_buffer = NULL;
#endif
if (old_string) {
free(old_string);
}
if (string_error) {
*error_buffer = _wcsdup(string_error);