hrev51603 adds 2 changesets to branch 'master'
old head: a61d30b83b1e3feb41e375b22c96729296b3cec0
new head: eb5604bcb04a17d8fded7867e01877faac7eb4b7
overview:
http://cgit.haiku-os.org/haiku/log/?qt=range&q=eb5604bcb04a+%5Ea61d30b83b1e
----------------------------------------------------------------------------
11dee0444f91: TextInput: Fix text width
Thanks PulkoMandy for teaching me how to use Debugger and part of the
interface kit..
Fixes #12608
Signed-off-by: Adrien Destugues <pulkomandy@xxxxxxxxxxxxx>
Thanks for investigating and finding the problem!
[ hyche <cvghy116@xxxxxxxxx> ]
eb5604bcb04a: UDP: keep a reference to domain when we need it
The domains could be deleted by other threads while we were using them
to handle incoming packets, leading to an use after free (deadbeef).
Keep a reference to the doamin as long as we need it so other threads
will not delete them.
Fixes #9721, #12567
[ Adrien Destugues <pulkomandy@xxxxxxxxxxxxx> ]
----------------------------------------------------------------------------
2 files changed, 18 insertions(+), 9 deletions(-)
src/add-ons/kernel/network/protocols/udp/udp.cpp | 25 +++++++++++++-------
src/kits/interface/TextInput.cpp | 2 +-
############################################################################
Commit: 11dee0444f911abba5555d3be056fb64f1f5eea4
URL: http://cgit.haiku-os.org/haiku/commit/?id=11dee0444f91
Author: hyche <cvghy116@xxxxxxxxx>
Date: Thu Nov 23 09:41:44 2017 UTC
Committer: Adrien Destugues <pulkomandy@xxxxxxxxxxxxx>
Commit-Date: Thu Nov 23 10:06:25 2017 UTC
Ticket: https://dev.haiku-os.org/ticket/12608
TextInput: Fix text width
Thanks PulkoMandy for teaching me how to use Debugger and part of the interface
kit..
Fixes #12608
Signed-off-by: Adrien Destugues <pulkomandy@xxxxxxxxxxxxx>
Thanks for investigating and finding the problem!
----------------------------------------------------------------------------
diff --git a/src/kits/interface/TextInput.cpp b/src/kits/interface/TextInput.cpp
index 65b178e..6ed6455 100644
--- a/src/kits/interface/TextInput.cpp
+++ b/src/kits/interface/TextInput.cpp
@@ -174,7 +174,7 @@ _BTextInput_::AlignTextRect()
float vInset = max_c(1,
floorf((textRect.Height() - LineHeight(0)) / 2.0));
float hInset = 2;
- float textFontWidth = TextRect().right;
+ float textFontWidth = TextRect().Width();
switch (Alignment()) {
case B_ALIGN_LEFT:
############################################################################
Revision: hrev51603
Commit: eb5604bcb04a17d8fded7867e01877faac7eb4b7
URL: http://cgit.haiku-os.org/haiku/commit/?id=eb5604bcb04a
Author: Adrien Destugues <pulkomandy@xxxxxxxxxxxxx>
Date: Thu Nov 23 11:07:24 2017 UTC
Ticket: https://dev.haiku-os.org/ticket/9721
Ticket: https://dev.haiku-os.org/ticket/12567
UDP: keep a reference to domain when we need it
The domains could be deleted by other threads while we were using them
to handle incoming packets, leading to an use after free (deadbeef).
Keep a reference to the doamin as long as we need it so other threads
will not delete them.
Fixes #9721, #12567
----------------------------------------------------------------------------
diff --git a/src/add-ons/kernel/network/protocols/udp/udp.cpp
b/src/add-ons/kernel/network/protocols/udp/udp.cpp
index 97926b1..adcf884 100644
--- a/src/add-ons/kernel/network/protocols/udp/udp.cpp
+++ b/src/add-ons/kernel/network/protocols/udp/udp.cpp
@@ -681,6 +681,8 @@ UdpEndpointManager::DumpEndpoints(int argc, char *argv[])
{
UdpDomainList::Iterator it =
sUdpEndpointManager->fDomains.GetIterator();
+ kprintf("===== UDP domain manager %p =====\n", sUdpEndpointManager);
+
while (it.HasNext())
it.Next()->DumpEndpoints();
@@ -704,8 +706,10 @@ UdpEndpointManager::ReceiveData(net_buffer *buffer)
}
status_t status = Deframe(buffer);
- if (status != B_OK)
+ if (status != B_OK) {
+ sUdpEndpointManager->FreeEndpoint(domainSupport);
return status;
+ }
status = domainSupport->DemuxIncomingBuffer(buffer);
if (status != B_OK) {
@@ -713,10 +717,12 @@ UdpEndpointManager::ReceiveData(net_buffer *buffer)
// Send port unreachable error
domainSupport->Domain()->module->error_reply(NULL, buffer,
B_NET_ERROR_UNREACH_PORT, NULL);
+ sUdpEndpointManager->FreeEndpoint(domainSupport);
return B_ERROR;
}
gBufferModule->free(buffer);
+ sUdpEndpointManager->FreeEndpoint(domainSupport);
return B_OK;
}
@@ -742,8 +748,10 @@ UdpEndpointManager::ReceiveError(status_t error,
net_buffer* buffer)
// original packet
udp_header header;
if (gBufferModule->read(buffer, 0, &header,
- std::min((size_t)buffer->size, sizeof(udp_header))) !=
B_OK)
+ std::min((size_t)buffer->size, sizeof(udp_header))) !=
B_OK) {
+ sUdpEndpointManager->FreeEndpoint(domainSupport);
return B_BAD_VALUE;
+ }
net_domain* domain = buffer->interface_address->domain;
net_address_module_info* addressModule = domain->address_module;
@@ -754,7 +762,9 @@ UdpEndpointManager::ReceiveError(status_t error,
net_buffer* buffer)
source.SetPort(header.source_port);
destination.SetPort(header.destination_port);
- return domainSupport->DeliverError(error, buffer);
+ error = domainSupport->DeliverError(error, buffer);
+ sUdpEndpointManager->FreeEndpoint(domainSupport);
+ return error;
}
@@ -896,11 +906,10 @@ UdpEndpointManager::_GetDomainSupport(net_buffer* buffer)
{
MutexLocker _(fLock);
- return _GetDomainSupport(_GetDomain(buffer), false);
- // TODO: we don't want to hold to the manager's lock during the
- // whole RX path, we may not hold an endpoint's lock with the
- // manager lock held.
- // But we should increase the domain's refcount here.
+ UdpDomainSupport* support = _GetDomainSupport(_GetDomain(buffer),
false);
+ if (support)
+ support->Ref();
+ return support;
}
