FlexASIO icon indicating copy to clipboard operation
FlexASIO copied to clipboard

Use-after-free bug in FlexASIO config watcher cleanup code

Open dechamps opened this issue 1 year ago • 0 comments

flexasio::ConfigLoader::Watcher sets up a ReadDirectoryChangesW overlapped I/O, but then never cancels it, even when the Watcher is being destroyed.

This can (and, in fact, probably will) result in ReadDirectoryChangesW writing to its buffer after it has been freed, potentially trampling over random data in application memory.

This will trigger memory corruption and undefined behavior with unpredictable consequences. The more often the application disposes FlexASIO buffers (which triggers config watcher cleanup), the more likely something bad will happen. In contrast, applications that dispose FlexASIO buffers only once right before exiting would be unlikely to show any symptoms.

It is possible this may be the root cause of #208.

The fix would be to call CancelIo() on the ReadDirectoryChangesW overlapped I/O and then wait for the I/O to complete before returning from the Watcher destructor. I suspect this might end up making the code simpler as there wouldn't be a need for a separate clean up event - the cancellation signals cleanup.

dechamps avatar Jan 14 '24 12:01 dechamps