mirror of
https://github.com/verilator/verilator.git
synced 2026-08-22 05:57:29 +02:00
Fix heap-use-after-free in VlRNG::VlRNG() due to dangling thread-local t_currentp
When a function (e.g. eval_static) creates a VlProcess via make_shared and sets VlProcess::currentp(vlProcess.get()), the thread-local t_currentp pointer is left dangling after the shared_ptr destroys the VlProcess object at function exit. A subsequent function (e.g. eval_initial) that constructs a new VlProcess triggers VlRNG::VlRNG(), which calls VlProcess::currentRng() and reads the freed t_currentp, causing a heap-use-after-free. Fix by clearing t_currentp in ~VlProcess() when it points to the dying object, redirecting to the parent process if one exists.
This commit is contained in:
@@ -61,6 +61,7 @@ David Turner
|
|||||||
Dercury
|
Dercury
|
||||||
Diego Roux
|
Diego Roux
|
||||||
Dominick Grochowina
|
Dominick Grochowina
|
||||||
|
Dragon-Git
|
||||||
Don Williamson
|
Don Williamson
|
||||||
Drew Ranck
|
Drew Ranck
|
||||||
Drew Taussig
|
Drew Taussig
|
||||||
|
|||||||
@@ -337,6 +337,7 @@ public:
|
|||||||
|
|
||||||
~VlProcess() {
|
~VlProcess() {
|
||||||
if (m_parentp) m_parentp->detach(this);
|
if (m_parentp) m_parentp->detach(this);
|
||||||
|
if (t_currentp == this) t_currentp = m_parentp;
|
||||||
}
|
}
|
||||||
|
|
||||||
void attach(VlProcess* childp) { m_children.insert(childp); }
|
void attach(VlProcess* childp) { m_children.insert(childp); }
|
||||||
|
|||||||
Reference in New Issue
Block a user