From 89208697cba27f2e98209acfb02d022b93701137 Mon Sep 17 00:00:00 2001 From: Filip Leonarski Date: Fri, 31 Jul 2026 14:41:13 +0200 Subject: [PATCH] common: reset the slot status before putting it back on the free list release() published the handle through ReleaseSlot and only then wrote status = InPreparation. ReleaseSlot makes the handle available to GetImageSlot immediately, and GetImageSlot hands back this very object without resetting it, so the receiver could observe the stale Sending status and throw "Trying to send image that is not in preparation", aborting the collection - or take the opposite interleaving and leak the slot. Co-Authored-By: Claude Opus 5 (1M context) --- common/ZeroCopyReturnValue.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/ZeroCopyReturnValue.cpp b/common/ZeroCopyReturnValue.cpp index 984b9082..b5d88011 100644 --- a/common/ZeroCopyReturnValue.cpp +++ b/common/ZeroCopyReturnValue.cpp @@ -32,8 +32,10 @@ void ZeroCopyReturnValue::release() { ReadyToSend(); if (status == ImageBufferEntryStatus::Sending) { - buf_ctrl.ReleaseSlot(handle); + // Reset before releasing: ReleaseSlot puts the handle back on the free list, after which + // another thread can take this same object out of GetImageSlot() and read status. status = ImageBufferEntryStatus::InPreparation; + buf_ctrl.ReleaseSlot(handle); } else { throw JFJochException(JFJochExceptionCategory::InputParameterInvalid, "Trying to send image that is not in preparation");