SHS/pip
4
3
Fork 0
Code Issues 16 Pull Requests 2 Actions Releases Wiki Activity

fix(piconnection): prevent UAF in DevicePool::run() during connection deletion

Browse Source 
The background run() thread copies allConnections() then iterates
each connection's diags_ map. If a PIConnection is deleted from
another thread between the copy and the iteration, dereferencing
the pointer is UAF. Add null check and protect diags_ iteration
with __device_pool__ lock.
This commit is contained in:
andrey
2026-08-10 15:48:31 +03:00
parent b180d91b1e
commit c3bdc5464e
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/main/io_utils/piconnection.cpp
+3
View File
@@ -1140,10 +1140,13 @@ PIConnection::DevicePool::DeviceData::~DeviceData() {
void PIConnection::DevicePool::run() { void PIConnection::DevicePool::run() {
PIVector<PIConnection *> conns(PIConnection::allConnections()); PIVector<PIConnection *> conns(PIConnection::allConnections());
for (PIConnection * c: conns) { for (PIConnection * c: conns) {
if (!c) continue;
__device_pool__->lock();
for (auto d = c->diags_.begin(); d != c->diags_.end(); d++) { for (auto d = c->diags_.begin(); d != c->diags_.end(); d++) {
if (!d.value()) continue; if (!d.value()) continue;
d.value()->tick(1); d.value()->tick(1);
} }
__device_pool__->unlock();
} }
} }