• Michael Stahl's avatar
    cppuhelper: fix use-after-free race in OWeakConnectionPoint · 131e6040
    Michael Stahl yazdı
    OWeakObject::m_pWeakConnectionPoint is returned from
    OWeakObject::queryAdapter(), and stored in
    OWeakRefListener::m_xWeakConnectionPoint.
    
    This is cleared in OWeakRefListener::dispose(), called from
    OWeakConnectionPoint::dispose(), called from
    OWeakObject::disposeWeakConnectionPoint(), but it can happen that
    another thread is in WeakReferenceHelper::get() and has copied
    m_xWeakConnectionPoint onto the stack before the OWeakObject is
    released and deleted, then calls OWeakConnectionPoint::queryAdapted()
    after it is released, accessing the dead m_pObject.
    
    Change-Id: I7782e6fb7e07f5a48cf7064115217376714ba8e8
    131e6040
weak.cxx 14.7 KB