Fix UAF in caRepeaterThread
The ca_repeater function has some failure cases which can cause it to return. In such a situation, a reference to the current thread's epicsThreadId is kept in the taskwd, causing an eventual use-after-free when the taskwd tries to determine the task's status. We fix this problem by removing the thread from the taskwd if ca_repeater ever returns.
This commit is contained in:
1 parent
2f460bdf26
commit
5b29ce506e
1 file changed
+1
@@ -645,6 +645,7 @@ extern "C" void caRepeaterThread ( void * /* pDummy */ )
|
||||
{
|
||||
taskwdInsert ( epicsThreadGetIdSelf(), NULL, NULL );
|
||||
ca_repeater ();
|
||||
taskwdRemove ( 0 );
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user