Skip to content

Commit e61bc85

Browse files
authored
fix use_of_uninitialized_value in message_loop_task_queues.cc (flutter#55520)
This issue was found with memory sanitizer. Commit f2f09b6 introduced a change that leads to use-after-free condition. In function MessageLoopTaskQueues::GetNextTaskToRun: 1) Call is made to PeekNextTaskUnlocked(queue_id);. Returned value contains a reference to to an object of const DelayedTask& taken from an std::queue container as returned by primary_task_queue_.top(). 2) Variable TaskSource::TopTask top now contains a reference to this object. 3) Function queue_entries_.at(top.task_queue_id)->task_source->PopTask(...) which in turn calls pop() method on std::queue. 4) Object of type DelayedTask on top of the queue gets deleted. 5) top.task.GetTaskSourceGrade() is called later with top.task refering to an already deleted object. *Replace this paragraph with a description of what this PR is changing or adding, and why. Consider including before/after screenshots.* *List which issues are fixed by this PR. You must list at least one issue.* *If you had to change anything in the [flutter/tests] repo, include a link to the migration guide as per the [breaking change policy].* [C++, Objective-C, Java style guides]: https://github.com/flutter/engine/blob/main/CONTRIBUTING.md#style
1 parent 5e08e4f commit e61bc85

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

fml/message_loop_task_queues.cc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -132,9 +132,8 @@ fml::closure MessageLoopTaskQueues::GetNextTaskToRun(TaskQueueId queue_id,
132132
return nullptr;
133133
}
134134
fml::closure invocation = top.task.GetTask();
135-
queue_entries_.at(top.task_queue_id)
136-
->task_source->PopTask(top.task.GetTaskSourceGrade());
137135
const auto task_source_grade = top.task.GetTaskSourceGrade();
136+
queue_entries_.at(top.task_queue_id)->task_source->PopTask(task_source_grade);
138137
tls_task_source_grade.reset(new TaskSourceGradeHolder{task_source_grade});
139138
return invocation;
140139
}

0 commit comments

Comments
 (0)