Skip to content

Commit 3daa2c5

Browse files
p4vookMikailBag
andcommitted
Fix use-after-free in zygote
Move declaration of thread arguments out of nested scope, so that the thread exits before its arguments will expire. Co-authored-by: Mikail Bagishov <bagishov.mikail@yandex.ru> Signed-off-by: Pavel Kalugin <paul.kalug@gmail.com>
1 parent c4dcb4f commit 3daa2c5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

src/linux/zygote.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -306,15 +306,15 @@ fn timed_wait(pid: Pid, timeout: Option<time::Duration>) -> Result<Option<ExitCo
306306
end_w = 0;
307307
setup_pipe(&mut end_r, &mut end_w)?;
308308
let waiter_pid;
309+
let mut waiter_arg = WaiterArg { res_fd: end_w, pid };
309310
{
310-
let mut arg = WaiterArg { res_fd: end_w, pid };
311311
let mut wpid = unsafe { std::mem::zeroed() };
312312
let ret = unsafe {
313313
libc::pthread_create(
314314
&mut wpid as *mut _,
315315
ptr::null(),
316316
timed_wait_waiter,
317-
&mut arg as *mut WaiterArg as *mut c_void,
317+
&mut waiter_arg as *mut WaiterArg as *mut c_void,
318318
)
319319
};
320320
waiter_pid = wpid;

0 commit comments

Comments
 (0)