瀏覽代碼

LibCore: Make sure to disable notifiers when closing a socket

RefPtr<Notifier> doesn't work quite like it appears to, since the notifier
is also a "child" of the socket, in Core::Object sense. Thus we have to both
remove it from the parent (socket) and drop the additional RefPtr<Notifier> for
it to actually go away.

A proper fix for this would be to untangle parent-child relashionship from
refcounting and inspectability.

This fixes use-after-close of client file descriptors in IPC servers.
Sergey Bugaev 5 年之前
父節點
當前提交
89004a3a40
共有 1 個文件被更改,包括 8 次插入1 次删除
  1. 8 1
      Libraries/LibCore/Socket.cpp

+ 8 - 1
Libraries/LibCore/Socket.cpp

@@ -181,7 +181,14 @@ bool Socket::send(const ByteBuffer& data)
 void Socket::did_update_fd(int fd)
 {
     if (fd < 0) {
-        m_read_notifier = nullptr;
+        if (m_read_notifier) {
+             m_read_notifier->remove_from_parent();
+             m_read_notifier = nullptr;
+        }
+        if (m_notifier) {
+            m_notifier->remove_from_parent();
+            m_notifier = nullptr;
+        }
         return;
     }
     if (m_connected) {