Fix UAF in caRepeaterThread

The ca_repeater function has some failure cases which can cause it to
return. In such a situation, a reference to the current thread's
epicsThreadId is kept in the taskwd, causing an eventual use-after-free
when the taskwd tries to determine the task's status.

We fix this problem by removing the thread from the taskwd if
ca_repeater ever returns.
This commit is contained in:
Érico Nogueira authored and Dirk Zimoch committed 2026-10-14 11:16:34 +02:00
1 parent 2f460bdf26
commit 5b29ce506e
1 file changed
+1
+1
View File
@@ -645,6 +645,7 @@ extern "C" void caRepeaterThread ( void * /* pDummy */ )
{
taskwdInsert ( epicsThreadGetIdSelf(), NULL, NULL );
ca_repeater ();
taskwdRemove ( 0 );
}