https://github.com/JDevlieghere created
https://github.com/llvm/llvm-project/pull/133840
The `locked` variable can be accessed from the asynchronous thread until the
call to f.wait() completes. However, the variable is scoped in a lexical block
that ends before that, leading to a use-after-free.
>From 1891a00e3c0fe05313053ca5ca898854d2e63c00 Mon Sep 17 00:00:00 2001
From: Jonas Devlieghere <jo...@devlieghere.com>
Date: Mon, 31 Mar 2025 19:33:12 -0700
Subject: [PATCH] [lldb] Fix use-after-free in SBMutexTest
The `locked` variable can be accessed from the asynchronous thread until
the call to f.wait() completes. However, the variable is scoped in a
lexical block that ends before that, leading to a use-after-free.
---
lldb/unittests/API/SBMutexTest.cpp | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/lldb/unittests/API/SBMutexTest.cpp
b/lldb/unittests/API/SBMutexTest.cpp
index 0b888c2725aa9..aafad59d58c17 100644
--- a/lldb/unittests/API/SBMutexTest.cpp
+++ b/lldb/unittests/API/SBMutexTest.cpp
@@ -32,10 +32,9 @@ class SBMutexTest : public testing::Test {
TEST_F(SBMutexTest, LockTest) {
lldb::SBTarget target = debugger.GetDummyTarget();
-
+ std::atomic<bool> locked = false;
std::future<void> f;
{
- std::atomic<bool> locked = false;
lldb::SBMutex lock = target.GetAPIMutex();
std::lock_guard<lldb::SBMutex> lock_guard(lock);
ASSERT_FALSE(locked.exchange(true));
_______________________________________________
lldb-commits mailing list
lldb-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits
