diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-06-08 17:03:34 +0900 |
|---|---|---|
| committer | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2014-06-08 17:03:34 +0900 |
| commit | 570bc24fb98d72d1bce9261fdc29139224ec86ec (patch) | |
| tree | ccf2c67ef8dda9cf91c88fd41941fe0b33ade65c /src/OptionHandlerFactory.cc | |
| parent | 442e460055fdf045cc70c87fac9f0dd481ad55e2 (diff) | |
Fix use-after-free on exit with multi-file torrent download + DHT
DefaultPieceStorage may be referenced by one of DHT task (e.g.,
DHTPeerLookupTask), after RequestGroup was deleted, and even after
RequestGroupMan was deleted. DefaultPieceStorage has a reference to
MultiDiskAdaptor which calls RequestGroupMan object on destruction.
So when DHT task is destroyed, DefaultPieceStorage is destroyed, which
in turn destroys MultiDiskAdaptor. DHT task is destroyed after
RequestGroupMan was destroyed, MultiDiskAdaptor will use now freed
RequestGroupMan object, this is use-after-free.
Diffstat (limited to 'src/OptionHandlerFactory.cc')
0 files changed, 0 insertions, 0 deletions