Skip to content

Commit

Permalink
fixes heap-use-after-free when cleaning up interaction
Browse files Browse the repository at this point in the history
Summary: Fixes heap-use-after-free bug by changing the lambda that cleans up a tile aka interaction to capture the variables needed before scheduling the lambda.

Differential Revision: D52223739

fbshipit-source-id: 770f4e83f29222fea8331adcdf5376596e228ff0
  • Loading branch information
Emanuele Altieri authored and facebook-github-bot committed Jan 9, 2024
1 parent f7c8a33 commit 3b3db56
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions third-party/thrift/src/thrift/lib/cpp2/async/AsyncProcessor.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -163,8 +163,9 @@ void GeneratedAsyncProcessorBase::processInteraction(ServerRequest&& req) {
apache::thrift::detail::ServerRequestHelper::setInternalPriority(
request, source);

apache::thrift::detail::ServerRequestHelper::resourcePool(request)->accept(
std::move(request));
auto&& resourcePool =
apache::thrift::detail::ServerRequestHelper::resourcePool(request);
resourcePool->accept(std::move(request));
}

bool GeneratedAsyncProcessorBase::createInteraction(ServerRequest& req) {
Expand Down Expand Up @@ -805,7 +806,8 @@ bool HandlerCallbackBase::fulfillTilePromise(std::unique_ptr<Tile> ptr) {
return false;
}

auto fn = [ctx = reqCtx_,
auto fn = [connCtx = reqCtx_->getConnectionContext(),
interactionId = reqCtx_->getInteractionId(),
interaction = std::move(interaction_),
ptr = std::move(ptr),
tm = getThreadManager_deprecated(),
Expand All @@ -819,8 +821,7 @@ bool HandlerCallbackBase::fulfillTilePromise(std::unique_ptr<Tile> ptr) {
} else {
static_cast<TilePromise&>(*interaction).fulfill(*tile, tm, *eb);
}
ctx->getConnectionContext()->tryReplaceTile(
ctx->getInteractionId(), std::move(tile));
connCtx->tryReplaceTile(interactionId, std::move(tile));
};

eb_->runImmediatelyOrRunInEventBaseThread(std::move(fn));
Expand Down

0 comments on commit 3b3db56

Please sign in to comment.