diff options
| author | Evgen Pervenenko <yauheni.pervenenka@viber.com> | 2024-11-04 19:12:32 +0300 |
|---|---|---|
| committer | Evgen Pervenenko <yauheni.pervenenka@viber.com> | 2024-11-18 17:33:23 +0000 |
| commit | 8a535cc1049c4304754b380daaefdece3a7c2e5b (patch) | |
| tree | 2b78650cbd41ee870de724279e4992b97cec1dec /src/corelib/io/qdebug.cpp | |
| parent | 1372764ead6ef44d9319cd018ce8882695df5cae (diff) | |
QNetworkConnectionMonitor[Mac]: Fix potential use-after/during-free
There is a potential race condition on Mac that can lead to crashes
when destroying `QNetworkConnectionMonitor`. This issue arises when
`QNetworkConnectionMonitorPrivate` has already been destroyed, but is
still being accessed through `QNCMP::probeCallback()` from another
thread.
To fix the issue, a reference counter is used.
This counter indicates whether the callback is being used in monitoring.
It increases when information is retained (when we set the callback,
the info retains to 1) and decreases when information is released
(the info releases to 0, when QNCMP object is not used in monitoring).
A waitCondition is used to notify all threads when the reference counter
reaches zero. The QNCMP::reset function waits until
the probeCallback is disconnected and the reference counter is zero.
This indicates that the info resource is free,
allowing us to safely destroy the QNCMP object.
The conditional variable protects
the QNetworkConnectionMonitorPrivate object and ensures
that the callback is disconnected properly.
Fixes: QTBUG-130552
Pick-to: 6.8 6.5
Change-Id: I1259c429e92bc20c382604192243d6d8fadb5c25
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Vladimir Belyavsky <belyavskyv@gmail.com>
Diffstat (limited to 'src/corelib/io/qdebug.cpp')
0 files changed, 0 insertions, 0 deletions
