Fix use after free in callbacks with results. #616
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is a use-after-free bug in menu state change callback.
in line CECClient.cpp:1656, cb->m_keepResult is check to find out if the callbackWrap needs to be deleted or not.
However in CCECClient::QueueMenuStateChanged, the callback is deleted right after Result().
By the time Report() finishes, the callback is already delted and thus the value if cb->m_keepResult should not be access and can become 0 leading to a double free.