christoph/wamr
1
Fork 0
Code Releases Activity

Fixing use after free when dumping call stack (#2084)

Browse Source 
In multi-threading, this line will eventually call `wasm_cluster_wait_for_all_except_self`:
`DEINIT_VEC(store->instances, wasm_instance_vec_delete)`

As the threads are joining they can call `wasm_interp_dump_call_stack` which tries to
use the module frames but they were already freed by this line:
`DEINIT_VEC(store->modules, wasm_module_vec_delete)`

This PR swaps the order that these are deleted so module is deleted after the instances.

Co-authored-by: Andrew Chambers <ncham@amazon.com>
This commit is contained in:
Andy
2023-03-30 09:01:16 +08:00
committed by GitHub
co-authored by Andrew Chambers
parent b0736e2e88
commit 5aa22d41e9
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/iwasm/common/wasm_c_api.c
+1 -1
View File
@@ -687,8 +687,8 @@ wasm_store_delete(wasm_store_t *store)
return;
}
DEINIT_VEC(store->modules, wasm_module_vec_delete);
DEINIT_VEC(store->instances, wasm_instance_vec_delete);
DEINIT_VEC(store->modules, wasm_module_vec_delete);
if (store->foreigns) {
bh_vector_destroy(store->foreigns);
wasm_runtime_free(store->foreigns);