oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

util/IntrusiveList: allow the last disposer to destroy the IntrusiveList

Browse Source 
Fixes a use-after-free bug in Co::MultiAwaitable::SetReady() when the
last callback frees the Co::MultiAwaitable owner.
This commit is contained in:
Max Kellermann 2023-02-17 12:40:04 +01:00 committed by Max Kellermann
parent 2f7c19f139
commit 669cbcd25a
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/util/IntrusiveList.hxx
View File

@ -283,8 +283,18 @@ public:
} }
void clear_and_dispose(Disposer<value_type> auto disposer) noexcept { void clear_and_dispose(Disposer<value_type> auto disposer) noexcept {
while (!empty()) { bool is_empty = empty();
disposer(&pop_front());
while (!is_empty) {
auto *item = &pop_front();
/* by checking empty() before invoking the
disposer, it is possible for the disposer
to destroy this IntrusiveList in the last
call */
is_empty = empty();
disposer(item);
} }
} }