https://gitlab.synchro.net/main/sbbs/-/commit/573398dc0201f069d0d90bdc
Modified Files:
src/xpdev/msg_queue.c msg_queue.h
Log Message:
Use protected integer for reference counter
Fix concurrency issue reported by Claude via Deuce:
msgQueueAttach() (line 77) does q->refs++ and msgQueueDetach() (line 92) does
--q->refs on a plain int with no locking or atomics. These are non-atomic
read-modify-write operations.
If two threads call msgQueueDetach() concurrently with refs == 2:
- Both read refs == 2, both write refs = 1, neither triggers the == 0 free
memory leak
If two threads call msgQueueDetach() concurrently with refs == 1:
- Both read refs == 1, both write refs = 0, both call msgQueueFree()
double-free
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net