Commit 68aed3b2 authored by Dominik Charousset's avatar Dominik Charousset

Fix UB when using prefix_and_tail

parent b832c273
...@@ -26,6 +26,8 @@ is based on [Keep a Changelog](https://keepachangelog.com). ...@@ -26,6 +26,8 @@ is based on [Keep a Changelog](https://keepachangelog.com).
respond with `void` (#1369). respond with `void` (#1369).
- Fix subscription and event handling in flow buffer operator. - Fix subscription and event handling in flow buffer operator.
- Fix undefined behavior in getter functions of the flow `mcast` operator. - Fix undefined behavior in getter functions of the flow `mcast` operator.
- Add checks to avoid potential UB when using `prefix_and_tail` or other
operators that use the `ucast` operator internally.
## [0.19.0-rc.1] - 2022-10-31 ## [0.19.0-rc.1] - 2022-10-31
......
...@@ -228,6 +228,9 @@ private: ...@@ -228,6 +228,9 @@ private:
buf_.pop_front(); buf_.pop_front();
--demand_; --demand_;
out_.on_next(item); out_.on_next(item);
// Note: on_next() may call dispose() and set out_ to nullptr.
if (!out_)
return;
} }
if (in_) { if (in_) {
pull(); pull();
......
...@@ -121,7 +121,7 @@ public: ...@@ -121,7 +121,7 @@ public:
} }
void request(size_t demand) override { void request(size_t demand) override {
// Only called by the out_, never by the sink_. The latter triggers // Only called by out_, never by sink_ (triggers on_sink_demand_change()).
prefix_demand_ += demand; prefix_demand_ += demand;
if (sub_ && !requested_prefix_) { if (sub_ && !requested_prefix_) {
sub_.request(prefix_size_); sub_.request(prefix_size_);
......
...@@ -123,6 +123,9 @@ public: ...@@ -123,6 +123,9 @@ public:
auto got_some = demand > 0 && !buf.empty(); auto got_some = demand > 0 && !buf.empty();
for (bool run = got_some; run; run = demand > 0 && !buf.empty()) { for (bool run = got_some; run; run = demand > 0 && !buf.empty()) {
out.on_next(buf.front()); out.on_next(buf.front());
// Note: on_next may call dispose().
if (disposed)
return;
buf.pop_front(); buf.pop_front();
--demand; --demand;
} }
...@@ -166,6 +169,8 @@ public: ...@@ -166,6 +169,8 @@ public:
} }
void request(size_t n) override { void request(size_t n) override {
if (!state_)
return;
state_->demand += n; state_->demand += n;
if (state_->when_demand_changed) if (state_->when_demand_changed)
state_->when_demand_changed.run(); state_->when_demand_changed.run();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment