Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixup use-after-free error in streams tee #102

Merged
merged 1 commit into from
Oct 14, 2022
Merged

Conversation

jasnell
Copy link
Member

@jasnell jasnell commented Oct 13, 2022

No description provided.

@jasnell
Copy link
Member Author

jasnell commented Oct 13, 2022

/cc @harrishancock @mikea

@@ -1660,10 +1660,14 @@ ReadableStreamJsController::ReadableStreamJsController(
: state(consumer.clone(js, this)) {}

ReadableStreamJsController::ReadableStreamJsController(kj::Own<ValueReadable> consumer)
: state(kj::mv(consumer)) {}
: state(kj::mv(consumer)) {
state.get<kj::Own<ValueReadable>>()->setOwner(this);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Root cause here is that the ValueReadable and ByteReadable were retaining the pointer to the previous owner. ReadableStreamJsSource was handling this case properly but missed it here.

@jasnell jasnell force-pushed the jsnell/maybe-fix-tee-uaf branch from 8349243 to 04d1f09 Compare October 13, 2022 20:40
@jasnell jasnell merged commit 39a3365 into main Oct 14, 2022
@jasnell jasnell deleted the jsnell/maybe-fix-tee-uaf branch October 14, 2022 14:37
harrishancock added a commit that referenced this pull request Oct 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants