Merge pull request ish-app#450 from stek29/fix-onexit-uaf

Fix UAF in ios_handle_exit
zerocc2014 · Jul 26, 2019 · f545efc · f545efc
2 parents f564a8c + 0c6bef6
commit f545efc
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/AppDelegate.m b/app/AppDelegate.m
@@ -28,10 +28,12 @@ static void ios_handle_exit(struct task *task, int code) {
     // this is called with pids_lock as an implementation side effect, please do not cite as an example of good API design
     if (task->parent != NULL && task->parent->parent != NULL)
         return;
+    // pid should be saved now since task would be freed
+    pid_t pid = task->pid;
     dispatch_async(dispatch_get_main_queue(), ^{
         [[NSNotificationCenter defaultCenter] postNotificationName:ProcessExitedNotification
                                                             object:nil
-                                                          userInfo:@{@"pid": @(task->pid),
+                                                          userInfo:@{@"pid": @(pid),
                                                                      @"code": @(code)}];
     });
 }