pmem / miniasync Goto Github PK

Consider the following code:

vdm_memcpy_future f;

std::thread t1([&]{
    f = vdm_memcpy(...): // with threads_mover
});
t1.join();

std::thread t2([&]{
    auto f2 = vdm_memcpy(...); // with threads_mover
    while (future_poll(&f, NULL) != FUTURE_STATE_COMPLETE);
});
t2.join();

It will most likely segfault because of use-after free in membuf. Inside t1 data_mover_threads_data is allocated from membuf, in thread-local buffer. When t1 finishes, it will mark the buffer as unused.

Then, inside t2 that same thread-local buffer is reused by f2. future_poll(&f, NULL) will then enqueue data allocated by t1 to the ringbuff and the background thread will process that data (now, already overwritten) leading to a use-after-free.

This problem might also occur for data_mover_sync.c but I did not test that.

The library exports all its non-static symbols, making ABI tracking ineffective, and risking conflicts with matching name in user projects.

Thus, please hide them, either by changing default visibility, or via a linker map.