Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WPF XpsSerialization crashes intermittently caused by double free #1554

Closed
rladuca opened this issue Aug 7, 2019 · 1 comment
Closed

WPF XpsSerialization crashes intermittently caused by double free #1554

rladuca opened this issue Aug 7, 2019 · 1 comment
Assignees
@rladuca
Labels
Bug Product bug (most likely) .NET Framework netfx-servicing-approved Netfx Approved for Servicing tell-mode Issues and PR's that require notice to .NET Core Shiproom
Milestone
3.0

Comments

@rladuca
Copy link
Member

rladuca commented Aug 7, 2019

This is a port of a .NET Framework servicing bug: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/961349

During execution of CreateTTFDeltaEx, the call-chain may re-allocate and move *ppuchDestBuffer. If this happens and an error condition occurs, we will return the buffer that realloc de-allocated. Callers may then double-free *ppuchDestBuffer.

To fix this, set *ppuchDestBuffer to NULL after it is stored in OutputBufferInfo.puchBuffer. After this change, the non-error return will set *ppuchDestBuffer to OutputBufferInfo.puchBuffer as always, but the error case will de-allocate OutputBufferInfo.puchBuffer (as was intended) and return NULL in *ppuchDestBuffer. Callers then cannot double-free the buffer.
@rladuca rladuca added this to the 3.0 milestone Aug 7, 2019
@rladuca rladuca self-assigned this Aug 7, 2019
@rladuca rladuca added area-netfx netfx-servicing-approved Netfx Approved for Servicing Bug Product bug (most likely) tell-mode Issues and PR's that require notice to .NET Core Shiproom labels Aug 7, 2019
@rladuca
Copy link
Member Author

rladuca commented Aug 7, 2019

Related to #1511

@rladuca rladuca mentioned this issue Aug 7, 2019
Merged
@grubioe grubioe mentioned this issue Aug 27, 2019
Closed
@ghost ghost locked as resolved and limited conversation to collaborators Apr 15, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@rladuca rladuca

Labels
Bug Product bug (most likely) .NET Framework netfx-servicing-approved Netfx Approved for Servicing tell-mode Issues and PR's that require notice to .NET Core Shiproom
Projects
None yet
Milestone
3.0
Development

No branches or pull requests
3 participants
@rladuca @vatsan-madhavan @ryalanms