Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(280)

Side by Side Diff: dart/runtime/bin/eventhandler_win.cc

Issue 925443002: Fix potential use-after-free bug in windows eventhandler (Closed) Base URL: https://dart.googlecode.com/svn/branches/bleeding_edge
Patch Set: Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file 1 // Copyright (c) 2013, the Dart project authors. Please see the AUTHORS file
2 // for details. All rights reserved. Use of this source code is governed by a 2 // for details. All rights reserved. Use of this source code is governed by a
3 // BSD-style license that can be found in the LICENSE file. 3 // BSD-style license that can be found in the LICENSE file.
4 4
5 #include "platform/globals.h" 5 #include "platform/globals.h"
6 #if defined(TARGET_OS_WINDOWS) 6 #if defined(TARGET_OS_WINDOWS)
7 7
8 #include "bin/eventhandler.h" 8 #include "bin/eventhandler.h"
9 #include "bin/eventhandler_win.h" 9 #include "bin/eventhandler_win.h"
10 10
(...skipping 1011 matching lines...) Expand 10 before | Expand all | Expand 10 after
1022 1022
1023 // We only close the socket file descriptor from the operating 1023 // We only close the socket file descriptor from the operating
1024 // system if there are no other dart socket objects which 1024 // system if there are no other dart socket objects which
1025 // are listening on the same (address, port) combination. 1025 // are listening on the same (address, port) combination.
1026 ListeningSocketRegistry *registry = 1026 ListeningSocketRegistry *registry =
1027 ListeningSocketRegistry::Instance(); 1027 ListeningSocketRegistry::Instance();
1028 MutexLocker locker(registry->mutex()); 1028 MutexLocker locker(registry->mutex());
1029 if (registry->CloseSafe(reinterpret_cast<intptr_t>(listen_socket))) { 1029 if (registry->CloseSafe(reinterpret_cast<intptr_t>(listen_socket))) {
1030 ASSERT(listen_socket->Mask() == 0); 1030 ASSERT(listen_socket->Mask() == 0);
1031 listen_socket->Close(); 1031 listen_socket->Close();
1032 DeleteIfClosed(handle);
1033 } 1032 }
1034 1033
1035 DartUtils::PostInt32(msg->dart_port, 1 << kDestroyedEvent); 1034 DartUtils::PostInt32(msg->dart_port, 1 << kDestroyedEvent);
1036 } else { 1035 } else {
1037 UNREACHABLE(); 1036 UNREACHABLE();
1038 } 1037 }
1039 } else { 1038 } else {
1040 handle->EnsureInitialized(this); 1039 handle->EnsureInitialized(this);
1041
1042 Handle::ScopedLock lock(handle); 1040 Handle::ScopedLock lock(handle);
1043 1041
1044 if (IS_COMMAND(msg->data, kReturnTokenCommand)) { 1042 if (IS_COMMAND(msg->data, kReturnTokenCommand)) {
1045 handle->ReturnTokens(msg->dart_port, TOKEN_COUNT(msg->data)); 1043 handle->ReturnTokens(msg->dart_port, TOKEN_COUNT(msg->data));
1046 } else if (IS_COMMAND(msg->data, kSetEventMaskCommand)) { 1044 } else if (IS_COMMAND(msg->data, kSetEventMaskCommand)) {
1047 // `events` can only have kInEvent/kOutEvent flags set. 1045 // `events` can only have kInEvent/kOutEvent flags set.
1048 intptr_t events = msg->data & EVENT_MASK; 1046 intptr_t events = msg->data & EVENT_MASK;
1049 ASSERT(0 == (events & ~(1 << kInEvent | 1 << kOutEvent))); 1047 ASSERT(0 == (events & ~(1 << kInEvent | 1 << kOutEvent)));
1050 1048
1051 handle->SetPortAndMask(msg->dart_port, events); 1049 handle->SetPortAndMask(msg->dart_port, events);
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after
1094 ASSERT(handle->is_client_socket()); 1092 ASSERT(handle->is_client_socket());
1095 1093
1096 ClientSocket* client_socket = reinterpret_cast<ClientSocket*>(handle); 1094 ClientSocket* client_socket = reinterpret_cast<ClientSocket*>(handle);
1097 client_socket->Shutdown(SD_SEND); 1095 client_socket->Shutdown(SD_SEND);
1098 } else if (IS_COMMAND(msg->data, kCloseCommand)) { 1096 } else if (IS_COMMAND(msg->data, kCloseCommand)) {
1099 handle->SetPortAndMask(msg->dart_port, 0); 1097 handle->SetPortAndMask(msg->dart_port, 0);
1100 handle->Close(); 1098 handle->Close();
1101 } else { 1099 } else {
1102 UNREACHABLE(); 1100 UNREACHABLE();
1103 } 1101 }
1104 DeleteIfClosed(handle);
1105 } 1102 }
1103
1104 DeleteIfClosed(handle);
1106 } 1105 }
1107 } 1106 }
1108 1107
1109 1108
1110 void EventHandlerImplementation::HandleAccept(ListenSocket* listen_socket, 1109 void EventHandlerImplementation::HandleAccept(ListenSocket* listen_socket,
1111 OverlappedBuffer* buffer) { 1110 OverlappedBuffer* buffer) {
1112 listen_socket->AcceptComplete(buffer, completion_port_); 1111 listen_socket->AcceptComplete(buffer, completion_port_);
1113 1112
1114 { 1113 {
1115 Handle::ScopedLock lock(listen_socket); 1114 Handle::ScopedLock lock(listen_socket);
(...skipping 272 matching lines...) Expand 10 before | Expand all | Expand 10 after
1388 1387
1389 1388
1390 void EventHandlerImplementation::Shutdown() { 1389 void EventHandlerImplementation::Shutdown() {
1391 SendData(kShutdownId, 0, 0); 1390 SendData(kShutdownId, 0, 0);
1392 } 1391 }
1393 1392
1394 } // namespace bin 1393 } // namespace bin
1395 } // namespace dart 1394 } // namespace dart
1396 1395
1397 #endif // defined(TARGET_OS_WINDOWS) 1396 #endif // defined(TARGET_OS_WINDOWS)
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698