diff options
| author | Glenn Smith <glenn@vector35.com> | 2023-01-02 16:43:41 -0500 |
|---|---|---|
| committer | Glenn Smith <glenn@vector35.com> | 2023-01-03 19:21:04 -0500 |
| commit | 63a93869607c85f8d456d49bd8c1837047721c15 (patch) | |
| tree | f96585dbff7373dacc5da85810fb13e6a3cf536e | |
| parent | 5088ccdc46c37db4cd95574575b8afd83113f839 (diff) | |
Fix UAF chance in BackgroundThread
If a the owning object is deleted in between the m_owner check and a main thread action being run, the action was not cancelled properly.
| -rw-r--r-- | ui/progresstask.h | 32 |
1 files changed, 24 insertions, 8 deletions
diff --git a/ui/progresstask.h b/ui/progresstask.h index 9245349c..08cc8685 100644 --- a/ui/progresstask.h +++ b/ui/progresstask.h @@ -303,12 +303,16 @@ class BINARYNINJAUIAPI BackgroundThread : public QObject { for (auto& func : m_then) { - if (m_hasOwner && !m_owner) + if (m_hasOwner && m_owner.isNull()) return; switch (func.first) { case MainThread: - BinaryNinja::ExecuteOnMainThreadAndWait([&]() { value = func.second(value); }); + BinaryNinja::ExecuteOnMainThreadAndWait([&]() { + if (m_hasOwner && m_owner.isNull()) + return; + value = func.second(value); + }); break; case Background: value = func.second(value); @@ -317,14 +321,18 @@ class BINARYNINJAUIAPI BackgroundThread : public QObject } for (auto& func : m_finally) { - if (m_hasOwner && !m_owner) + if (m_hasOwner && m_owner.isNull()) return; try { switch (func.first) { case MainThread: - BinaryNinja::ExecuteOnMainThreadAndWait([&]() { func.second(true); }); + BinaryNinja::ExecuteOnMainThreadAndWait([&]() { + if (m_hasOwner && m_owner.isNull()) + return; + func.second(true); + }); break; case Background: func.second(true); @@ -349,14 +357,18 @@ class BINARYNINJAUIAPI BackgroundThread : public QObject std::exception_ptr exc = std::current_exception(); for (auto& func : m_catch) { - if (m_hasOwner && !m_owner) + if (m_hasOwner && m_owner.isNull()) return; try { switch (func.first) { case MainThread: - BinaryNinja::ExecuteOnMainThreadAndWait([&]() { func.second(exc); }); + BinaryNinja::ExecuteOnMainThreadAndWait([&]() { + if (m_hasOwner && m_owner.isNull()) + return; + func.second(exc); + }); break; case Background: func.second(exc); @@ -370,14 +382,18 @@ class BINARYNINJAUIAPI BackgroundThread : public QObject } for (auto& func : m_finally) { - if (m_hasOwner && !m_owner) + if (m_hasOwner && m_owner.isNull()) return; try { switch (func.first) { case MainThread: - BinaryNinja::ExecuteOnMainThreadAndWait([&]() { func.second(false); }); + BinaryNinja::ExecuteOnMainThreadAndWait([&]() { + if (m_hasOwner && m_owner.isNull()) + return; + func.second(false); + }); break; case Background: func.second(false); |