fix(piconnection): prevent UAF in DevicePool::run() during connection deletion
The background run() thread copies allConnections() then iterates each connection's diags_ map. If a PIConnection is deleted from another thread between the copy and the iteration, dereferencing the pointer is UAF. Add null check and protect diags_ iteration with __device_pool__ lock.
This commit is contained in:
@@ -1140,10 +1140,13 @@ PIConnection::DevicePool::DeviceData::~DeviceData() {
|
||||
void PIConnection::DevicePool::run() {
|
||||
PIVector<PIConnection *> conns(PIConnection::allConnections());
|
||||
for (PIConnection * c: conns) {
|
||||
if (!c) continue;
|
||||
__device_pool__->lock();
|
||||
for (auto d = c->diags_.begin(); d != c->diags_.end(); d++) {
|
||||
if (!d.value()) continue;
|
||||
d.value()->tick(1);
|
||||
}
|
||||
__device_pool__->unlock();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user