handle_wrap: fix NULL pointer dereference

Fix a NULL pointer dereference in src/handle_wrap.cc which is really a
use-after-close bug.

The test checks that unref() after close() works on process.stdout but
this bug affects everything that derives from HandleWrap. I discovered
it because child processes would sometimes quit for no reason (that is,
no reason until I turned on core dumps.)
This commit is contained in:
Ben Noordhuis
2013-04-16 22:59:35 +02:00
parent 7592615aaa
commit ccd37226c6
2 changed files with 25 additions and 2 deletions

View File

@@ -57,7 +57,7 @@ Handle<Value> HandleWrap::Ref(const Arguments& args) {
UNWRAP_NO_ABORT(HandleWrap)
if (wrap) {
if (wrap != NULL && wrap->handle__ != NULL) {
uv_ref(wrap->handle__);
wrap->flags_ &= ~kUnref;
}
@@ -71,7 +71,7 @@ Handle<Value> HandleWrap::Unref(const Arguments& args) {
UNWRAP_NO_ABORT(HandleWrap)
if (wrap) {
if (wrap != NULL && wrap->handle__ != NULL) {
uv_unref(wrap->handle__);
wrap->flags_ |= kUnref;
}

View File

@@ -0,0 +1,23 @@
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to permit
// persons to whom the Software is furnished to do so, subject to the
// following conditions:
//
// The above copyright notice and this permission notice shall be included
// in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
// USE OR OTHER DEALINGS IN THE SOFTWARE.
process.stdout._handle.close();
process.stdout._handle.unref(); // Should not segfault.