Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit c440748

Browse filesBrowse files
committed
n-api: fix use-after-free with napi_remove_async_cleanup_hook
Fixes: #34657 Refs: #34572 PR-URL: #34662 Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 148383f commit c440748
Copy full SHA for c440748

File tree

Expand file treeCollapse file tree

1 file changed

+6
-0
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

1 file changed

+6
-0
lines changed
Open diff view settings
Collapse file

‎src/node_api.cc‎

Copy file name to clipboardExpand all lines: src/node_api.cc
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,7 @@ napi_status napi_add_async_cleanup_hook(
533533
auto handle = node::AddEnvironmentCleanupHook(env->isolate, fun, arg);
534534
if (remove_handle != nullptr) {
535535
*remove_handle = new napi_async_cleanup_hook_handle__ { std::move(handle) };
536+
env->Ref();
536537
}
537538

538539
return napi_clear_last_error(env);
@@ -547,6 +548,11 @@ napi_status napi_remove_async_cleanup_hook(
547548
node::RemoveEnvironmentCleanupHook(std::move(remove_handle->handle));
548549
delete remove_handle;
549550

551+
// Release the `env` handle asynchronously since it would be surprising if
552+
// a call to a N-API function would destroy `env` synchronously.
553+
static_cast<node_napi_env>(env)->node_env()
554+
->SetImmediate([env](node::Environment*) { env->Unref(); });
555+
550556
return napi_clear_last_error(env);
551557
}
552558

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.