src: fix use-after-free in inspector agent · nodejs/node@80b10b4
@@ -209,7 +209,7 @@ class AgentImpl {
209209 State state_;
210210 node::Environment* parent_env_;
211211212-uv_async_t data_written_;
212+uv_async_t* data_written_;
213213uv_async_t io_thread_req_;
214214inspector_socket_t* client_socket_;
215215 blink::V8Inspector* inspector_;
@@ -317,31 +317,34 @@ AgentImpl::AgentImpl(Environment* env) : port_(0),
317317 shutting_down_(false),
318318 state_(State::kNew),
319319 parent_env_(env),
320+ data_written_(new uv_async_t()),
320321 client_socket_(nullptr),
321322 inspector_(nullptr),
322323 platform_(nullptr),
323324 dispatching_messages_(false),
324325 frontend_session_id_(0),
325326 backend_session_id_(0) {
326327CHECK_EQ(0, uv_sem_init(&start_sem_, 0));
327-memset(&data_written_, 0, sizeof(data_written_));
328328memset(&io_thread_req_, 0, sizeof(io_thread_req_));
329+CHECK_EQ(0, uv_async_init(env->event_loop(), data_written_, nullptr));
330+uv_unref(reinterpret_cast<uv_handle_t*>(data_written_));
329331}
330332331333AgentImpl::~AgentImpl() {
332-if (!inspector_)
333-return;
334-uv_close(reinterpret_cast<uv_handle_t*>(&data_written_), nullptr);
334+auto close_cb = [](uv_handle_t* handle) {
335+delete reinterpret_cast<uv_async_t*>(handle);
336+ };
337+uv_close(reinterpret_cast<uv_handle_t*>(data_written_), close_cb);
338+ data_written_ = nullptr;
335339}
336340337341bool AgentImpl::Start(v8::Platform* platform, int port, bool wait) {
338342auto env = parent_env_;
339343 inspector_ = new V8NodeInspector(this, env, platform);
340344 platform_ = platform;
341-int err = uv_async_init(env->event_loop(), &data_written_, nullptr);
342-CHECK_EQ(err, 0);
343345344-uv_unref(reinterpret_cast<uv_handle_t*>(&data_written_));
346+int err = uv_loop_init(&child_loop_);
347+CHECK_EQ(err, 0);
345348346349 port_ = port;
347350 wait_ = wait;
@@ -517,7 +520,7 @@ void AgentImpl::PostIncomingMessage(const String16& message) {
517520 platform_->CallOnForegroundThread(isolate,
518521new DispatchOnInspectorBackendTask(this));
519522 isolate->RequestInterrupt(InterruptCallback, this);
520-uv_async_send(&data_written_);
523+uv_async_send(data_written_);
521524}
522525523526void AgentImpl::OnInspectorConnectionIO(inspector_socket_t* socket) {
@@ -559,7 +562,7 @@ void AgentImpl::DispatchMessages() {
559562 inspector_->dispatchMessageFromFrontend(message);
560563 }
561564 }
562-uv_async_send(&data_written_);
565+uv_async_send(data_written_);
563566 dispatching_messages_ = false;
564567}
565568