mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-01 07:28:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

channel.c: Fix for heap-use-after-free

Browse Source 
ASAN detected this heap-use-after-free.
A job started by channel_from_job() could terminate and result in a call
to free_channel(), while channel_send_call() was still active/pending
and accessing Channel elements.

Original patch by @tarruda.
This commit is contained in:
oni-link
2014-12-03 12:45:31 +01:00
parent e2e63832e3
commit eae3105ee3
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/nvim/msgpack_rpc/channel.c
View File

@@ -348,7 +348,13 @@ static void job_err(RStream *rstream, void *data, bool eof)
static void job_exit(Job *job, void *data)
{
free_channel((Channel *)data);
Channel *channel = data;
// ensure the channel is flagged as closed so channel_send_call frees it
// later
channel->closed = true;
if (!kv_size(channel->call_stack)) {
free_channel(channel);
}
}
static void parse_msgpack(RStream *rstream, void *data, bool eof)