Skip to content

Commit

Permalink
Fix possible use-after-free in TT::release
Browse files Browse the repository at this point in the history
Signed-off-by: Joseph Schuchart <[email protected]>
  • Loading branch information
devreal committed Dec 21, 2023
1 parent 0d64297 commit 5f876e3
Showing 1 changed file with 3 additions and 13 deletions.
16 changes: 3 additions & 13 deletions ttg/ttg/parsec/ttg.h
Original file line number Diff line number Diff line change
Expand Up @@ -3773,18 +3773,6 @@ ttg::abort(); // should not happen
self.name = nullptr;
}

for (int i = 0; i < MAX_PARAM_COUNT; i++) {
parsec_flow_t *flow = (parsec_flow_t *)(self.in[i]);
free(flow->name);
delete flow;
*((parsec_flow_t **)&(self.in[i])) = nullptr;

flow = (parsec_flow_t *)(self.out[i]);
free(flow->name);
delete flow;
*((parsec_flow_t **)&(self.out[i])) = nullptr;
}

for (std::size_t i = 0; i < numins; ++i) {
if (inpute_reducers_taskclass[i] != nullptr) {
std::free(inpute_reducers_taskclass[i]);
Expand Down Expand Up @@ -3818,14 +3806,16 @@ ttg::abort(); // should not happen
// uintptr_t addr = (uintptr_t)self.incarnations;
// free((void *)addr);
free((__parsec_chore_t *)self.incarnations);
for (int i = 0; i < numflows; i++) {
for (int i = 0; i < MAX_PARAM_COUNT; i++) {
if (NULL != self.in[i]) {
free(self.in[i]->name);
delete self.in[i];
self.in[i] = nullptr;
}
if (NULL != self.out[i]) {
free(self.out[i]->name);
delete self.out[i];
self.out[i] = nullptr;
}
}
world.impl().deregister_op(this);
Expand Down

0 comments on commit 5f876e3

Please sign in to comment.