Bug 61385 - wayland-client.c:dispatch_event() dereferences proxy after free
Summary: wayland-client.c:dispatch_event() dereferences proxy after free
Status: RESOLVED FIXED
Alias: None
Product: Wayland
Classification: Unclassified
Component: wayland (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Wayland bug list
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-24 08:47 UTC by Siddharth Heroor
Modified: 2013-03-17 20:24 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
clang-analyzer output (140.70 KB, text/plain)
2013-02-24 08:47 UTC, Siddharth Heroor
Details

Description Siddharth Heroor 2013-02-24 08:47:16 UTC
Created attachment 75438 [details]
clang-analyzer output

In dispatch_event(), we call free(proxy) but if proxy_destroyed is false then the function does not return but continues further by accessing proxy->object.implementation.

Caught this by running clang-analyzer on wayland. See attachment.
Comment 1 Jonas Ådahl 2013-02-24 08:59:59 UTC
Even though the static analyzer cought this, it can never happen in practice. This is because for a proxy object to reach reference count zero the owner must destroy it using wl_proxy_destroy(). This has the side effect of adding the WL_PROXY_FLAG_DESTROYED flag, which would hit the

if (proxy_destroyed) {
        wl_closure_destroy(closure);
        return;
}

statement. However, I can add some extra checks to make the static analyzer more happy.
Comment 2 Siddharth Heroor 2013-02-25 12:10:02 UTC
Sound good. Will look for the patch.
Comment 3 Jonas Ådahl 2013-03-07 22:34:30 UTC
This patch fixes the warning when using scan-build from llvm trunk as of today:
http://lists.freedesktop.org/archives/wayland-devel/2013-March/007811.html
Comment 4 Kristian Høgsberg 2013-03-17 20:24:40 UTC
commit e053a5625129bd11c301c9587f5f29cbda95c66d
Author: Jonas Ådahl <jadahl@gmail.com>
Date:   Thu Mar 7 23:32:39 2013 +0100

    client: Check reference count only for destroyed proxies
    
    The llvm static analyzer tool reported "Use of memory after it is freed"
    in dispatch_event() because the proxy is used after being freed if the
    reference count reaches zero without the destroyed flag being set. This
    would never happen in practice because the owner of the proxy object
    always holds a reference until calling wl_proxy_destroy() which would
    also set the destroyed flag.
    
    Since this is the case, it is safe to do the reference count check only
    if the destroyed flag is set, as it can never reach zero if not.
    
    This commit doesn't change the behavior of the function, but makes the
    static analyzer more happy.
    
    Fixes https://bugs.freedesktop.org/show_bug.cgi?id=61385
    
    Signed-off-by: Jonas Ådahl <jadahl@gmail.com>


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.