Skip to content

Commit ec0d4b9

Browse files
Fix crash due to UAF
1 parent c27747a commit ec0d4b9

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

requests.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -570,9 +570,11 @@ VOID CALLBACK
570570
handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)
571571
{
572572
Request *req;
573+
HANDLE doneEvent;
573574
bool done;
574575

575576
req = (Request *)reqArg;
577+
doneEvent = req->doneEvent;
576578
done = false;
577579
while (!done) {
578580
if (req->source == REQ_SRC_UNSET) {
@@ -602,8 +604,8 @@ handle_request(PTP_CALLBACK_INSTANCE inst, void *reqArg, PTP_WORK work)
602604
}
603605
}
604606

605-
if (req->doneEvent != INVALID_HANDLE_VALUE) {
606-
SetEvent(req->doneEvent);
607+
if (doneEvent != INVALID_HANDLE_VALUE) {
608+
SetEvent(doneEvent);
607609
}
608610
}
609611

0 commit comments

Comments
 (0)