mirrors/Atmosphere
1
0
Fork 0
mirror of https://github.com/Atmosphere-NX/Atmosphere.git synced 2024-11-05 19:51:45 +00:00
Code Issues Releases Activity

libstrat: fix potential oob deref in WaitableManager (closes #256)

Browse source
This commit is contained in:
Michael Scire 2018-11-07 19:09:58 -08:00
parent 2894989eb7
commit bac81f4ccc
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
stratosphere/libstratosphere/include/stratosphere/waitable_manager.hpp
View file

@ -211,11 +211,10 @@ class WaitableManager : public SessionManagerBase {
/* Wait forever. */ /* Wait forever. */
rc = svcWaitSynchronization(&handle_index, handles.data(), num_handles, U64_MAX); rc = svcWaitSynchronization(&handle_index, handles.data(), num_handles, U64_MAX);
IWaitable *w = wait_list[handle_index];
size_t w_ind = std::distance(this->waitables.begin(), std::find(this->waitables.begin(), this->waitables.end(), w));
if (R_SUCCEEDED(rc)) { if (R_SUCCEEDED(rc)) {
IWaitable *w = wait_list[handle_index];
size_t w_ind = std::distance(this->waitables.begin(), std::find(this->waitables.begin(), this->waitables.end(), w));
std::for_each(waitables.begin(), waitables.begin() + w_ind, std::mem_fn(&IWaitable::UpdatePriority)); std::for_each(waitables.begin(), waitables.begin() + w_ind, std::mem_fn(&IWaitable::UpdatePriority));
result = w; result = w;
} else if (rc == 0xEA01) { } else if (rc == 0xEA01) {
@ -233,6 +232,8 @@ class WaitableManager : public SessionManagerBase {
} else if (rc != 0xF601 && rc != 0xE401) { } else if (rc != 0xF601 && rc != 0xE401) {
std::abort(); std::abort();
} else { } else {
IWaitable *w = wait_list[handle_index];
size_t w_ind = std::distance(this->waitables.begin(), std::find(this->waitables.begin(), this->waitables.end(), w));
this->waitables.erase(this->waitables.begin() + w_ind); this->waitables.erase(this->waitables.begin() + w_ind);
std::for_each(waitables.begin(), waitables.begin() + w_ind - 1, std::mem_fn(&IWaitable::UpdatePriority)); std::for_each(waitables.begin(), waitables.begin() + w_ind - 1, std::mem_fn(&IWaitable::UpdatePriority));
delete w; delete w;