Changeset 3234 for trunk/src/kmk

Timestamp:

Oct 28, 2018, 3:12:38 PM (7 years ago)

Author:

bird

Message:

kmk/job.c: Fixed a use-after-free problem in die() when flushing a stale output_context. Make sure free_child() doesn't leave a stale output_context behind.

File:

• trunk/src/kmk/job.c (modified) (1 diff)

trunk/src/kmk/job.c

@@ -1125 +1125 @@
   output_close (&child->output);
 
+  /* bird: Make sure the output_context doesn't point to a freed structure when
+           we return from this function.  This is probably an issue elsewhere
+           in the code, however it doesn't cost us much fixing it here.  (The
+           access after free was caught in a die() scenario, both in error
+           situations and successful ones.)  */
+  if (output_context == &child->output)
+    OUTPUT_UNSET();
+
   if (!jobserver_tokens)
     ONS (fatal, NILF, "INTERNAL: Freeing child %p (%s) but no tokens left!\n",