Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use-after-free bug in FlexASIO config watcher cleanup code #209

Closed
dechamps opened this issue Jan 14, 2024 · 1 comment
Closed

Use-after-free bug in FlexASIO config watcher cleanup code #209

dechamps opened this issue Jan 14, 2024 · 1 comment
Labels
Milestone

Comments

@dechamps
Copy link
Owner

dechamps commented Jan 14, 2024

flexasio::ConfigLoader::Watcher sets up a ReadDirectoryChangesW overlapped I/O, but then never cancels it, even when the Watcher is being destroyed.

This can (and, in fact, probably will) result in ReadDirectoryChangesW writing to its buffer after it has been freed, potentially trampling over random data in application memory.

This will trigger memory corruption and undefined behavior with unpredictable consequences. The more often the application disposes FlexASIO buffers (which triggers config watcher cleanup), the more likely something bad will happen. In contrast, applications that dispose FlexASIO buffers only once right before exiting would be unlikely to show any symptoms.

It is possible this may be the root cause of #208.

The fix would be to call CancelIo() on the ReadDirectoryChangesW overlapped I/O and then wait for the I/O to complete before returning from the Watcher destructor. I suspect this might end up making the code simpler as there wouldn't be a need for a separate clean up event - the cancellation signals cleanup.

@dechamps
Copy link
Owner Author

This is fixed in FlexASIO 1.10.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant