소스 검색

Fixing use after free when dumping call stack (#2084)

In multi-threading, this line will eventually call `wasm_cluster_wait_for_all_except_self`:
`DEINIT_VEC(store->instances, wasm_instance_vec_delete)`

As the threads are joining they can call `wasm_interp_dump_call_stack` which tries to
use the module frames but they were already freed by this line:
`DEINIT_VEC(store->modules, wasm_module_vec_delete)`

This PR swaps the order that these are deleted so module is deleted after the instances.

Co-authored-by: Andrew Chambers <ncham@amazon.com>
Andy 3 년 전
부모
커밋
5aa22d41e9
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      core/iwasm/common/wasm_c_api.c

+ 1 - 1
core/iwasm/common/wasm_c_api.c

@@ -687,8 +687,8 @@ wasm_store_delete(wasm_store_t *store)
         return;
         return;
     }
     }
 
 
-    DEINIT_VEC(store->modules, wasm_module_vec_delete);
     DEINIT_VEC(store->instances, wasm_instance_vec_delete);
     DEINIT_VEC(store->instances, wasm_instance_vec_delete);
+    DEINIT_VEC(store->modules, wasm_module_vec_delete);
     if (store->foreigns) {
     if (store->foreigns) {
         bh_vector_destroy(store->foreigns);
         bh_vector_destroy(store->foreigns);
         wasm_runtime_free(store->foreigns);
         wasm_runtime_free(store->foreigns);