From b45f27c8d05cff9b439dd72f728e065877f04fd1 Mon Sep 17 00:00:00 2001 From: Ryan Houdek Date: Fri, 5 Aug 2022 23:00:13 -0700 Subject: [PATCH] FEXServer: Fix unsafe vector insert/removal Depending on the operation we will do a vector insert or removal while iterating over the vector. Fixes a use after free that asan found when insert caused the vector to resize. --- Source/Tools/FEXServer/ProcessPipe.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Source/Tools/FEXServer/ProcessPipe.cpp b/Source/Tools/FEXServer/ProcessPipe.cpp index 7e916e0e1..180805a45 100644 --- a/Source/Tools/FEXServer/ProcessPipe.cpp +++ b/Source/Tools/FEXServer/ProcessPipe.cpp @@ -434,6 +434,8 @@ namespace ProcessPipe { ts.tv_sec = RequestTimeout; int Result = ppoll(&PollFDs.at(0), PollFDs.size(), &ts, nullptr); + std::vector NewPollFDs{}; + if (Result > 0) { // Walk the FDs and see if we got any results for (auto it = PollFDs.begin(); it != PollFDs.end(); ) { @@ -448,8 +450,8 @@ namespace ProcessPipe { socklen_t AddrSize{}; int NewFD = accept(ServerSocketFD, reinterpret_cast(&Addr), &AddrSize); - // Add the new client to the array - PollFDs.emplace_back(pollfd { + // Add the new client to the temporary array + NewPollFDs.emplace_back(pollfd { .fd = NewFD, .events = POLLIN | POLLPRI | POLLRDHUP | POLLREMOVE, .revents = 0, @@ -490,6 +492,9 @@ namespace ProcessPipe { } } + // Insert the new FDs to poll + PollFDs.insert(PollFDs.begin(), NewPollFDs.begin(), NewPollFDs.end()); + LastDataTime = std::chrono::system_clock::now(); } else {