Skip to content

Commit ccd3722

Browse files
bnoordhuisbnoordhuis
committed
handle_wrap: fix NULL pointer dereference
Fix a NULL pointer dereference in src/handle_wrap.cc which is really a use-after-close bug. The test checks that unref() after close() works on process.stdout but this bug affects everything that derives from HandleWrap. I discovered it because child processes would sometimes quit for no reason (that is, no reason until I turned on core dumps.)
1 parent 7592615 commit ccd3722

2 files changed

Lines changed: 25 additions & 2 deletions

File tree

‎src/handle_wrap.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ Handle<Value> HandleWrap::Ref(const Arguments& args) {
5757

5858
UNWRAP_NO_ABORT(HandleWrap)
5959

60-
if (wrap) {
60+
if (wrap != NULL && wrap->handle__ != NULL) {
6161
uv_ref(wrap->handle__);
6262
wrap->flags_ &= ~kUnref;
6363
}
@@ -71,7 +71,7 @@ Handle<Value> HandleWrap::Unref(const Arguments& args) {
7171

7272
UNWRAP_NO_ABORT(HandleWrap)
7373

74-
if (wrap) {
74+
if (wrap != NULL && wrap->handle__ != NULL) {
7575
uv_unref(wrap->handle__);
7676
wrap->flags_ |= kUnref;
7777
}

‎test/simple/test-stdout-close-unref.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Copyright Joyent, Inc. and other Node contributors.
2+
//
3+
// Permission is hereby granted, free of charge, to any person obtaining a
4+
// copy of this software and associated documentation files (the
5+
// "Software"), to deal in the Software without restriction, including
6+
// without limitation the rights to use, copy, modify, merge, publish,
7+
// distribute, sublicense, and/or sell copies of the Software, and to permit
8+
// persons to whom the Software is furnished to do so, subject to the
9+
// following conditions:
10+
//
11+
// The above copyright notice and this permission notice shall be included
12+
// in all copies or substantial portions of the Software.
13+
//
14+
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15+
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16+
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
17+
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
18+
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
19+
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
20+
// USE OR OTHER DEALINGS IN THE SOFTWARE.
21+
22+
process.stdout._handle.close();
23+
process.stdout._handle.unref(); // Should not segfault.

0 commit comments

Comments
 (0)