Skip to content

Commit ee1b796

Browse files
authored
bugfix: Use after free in fs.cpp's watch method (#568)
This use after free manifested intermittently when running lots and lots of tests at a time in this PR: #557. The cause of this uaf happens because we do not close the `fs_event_t` handle. When the `WatchHandle` wrapper gets closed, it invoked `uv_event_stop` but not `uv_close`, so the memory associated with the handle gets freed, but `libuv` doesn't know that this handle is closed. This causes uv's internal data structures to get messed up and we may accidentally touch this freed memory causing the Use-After-Free. `WatchHandle::close` already invokes `uv_event_stop`, so we can remove this from the implementation of `closeHandle`.
1 parent 98807fa commit ee1b796

File tree

1 file changed

+2
-6
lines changed

1 file changed

+2
-6
lines changed

lute/fs/src/fs.cpp

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,8 @@ struct WatchHandle
561561
luaL_errorL(L, "Error stopping fs event: %s", uv_strerror(err));
562562
}
563563

564+
uv_close((uv_handle_t*) &handle, nullptr);
565+
564566
isClosed = true;
565567

566568
getRuntime(L)->releasePendingToken();
@@ -586,12 +588,6 @@ static int closeWatchHandle(lua_State* L)
586588
return 0;
587589
}
588590

589-
int err = uv_fs_event_stop(&handle->handle);
590-
if (err)
591-
{
592-
luaL_errorL(L, "Error stopping fs event: %s", uv_strerror(err));
593-
}
594-
595591
handle->close();
596592

597593
return 0;

0 commit comments

Comments
 (0)