diff options
| author | Vito Caputo <vcaputo@pengaru.com> | 2023-01-21 11:04:39 -0800 |
|---|---|---|
| committer | Vito Caputo <vcaputo@pengaru.com> | 2023-01-21 13:34:12 -0800 |
| commit | 9c5d17309be237f799105e252a26e2c32c2d9c50 (patch) | |
| tree | 1aaf085eec9480a979a45c3e75c2acca18651033 | |
| parent | 54c35f22204982eef4eb606d0bf58ea945a2c0b5 (diff) | |
til_stream: teardown pipes when the driving_tap's owner matches
The driving tap's owner and pipe's owner are decoupled. When
tearing down an owner from a stream, any pipes its taps are
driving should also just go away. Otherwise its taps could
linger on pipes it doesn't own, which would be a UAF bug.
If the pipe is still needed, it'll just get recreated by another
tap. So there's a small perf hit, but this shouldn't be a
continuos kind of occurrence.
| -rw-r--r-- | src/til_stream.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/til_stream.c b/src/til_stream.c index c5e8326..fc3fc3c 100644 --- a/src/til_stream.c +++ b/src/til_stream.c @@ -203,14 +203,14 @@ int til_stream_tap(til_stream_t *stream, const void *owner, const void *owner_fo } -/* remove all pipes belonging to owner in stream */ +/* remove all pipes belonging to owner in stream, including pipes whose driving_tap is owned by owner */ void til_stream_untap_owner(til_stream_t *stream, const void *owner) { for (int i = 0; i < TIL_STREAM_BUCKETS_COUNT; i++) { for (til_stream_pipe_t *p = stream->buckets[i], *p_next, *p_prev; p != NULL; p = p_next) { p_next = p->next; - if (p->owner == owner) { + if (p->owner == owner || p->driving_tap->owner == owner) { if (p == stream->buckets[i]) stream->buckets[i] = p_next; else |