Skip to content

Commit 5aa22d4

Browse files
nchamznAndrew Chambers
andauthored
Fixing use after free when dumping call stack (#2084)
In multi-threading, this line will eventually call `wasm_cluster_wait_for_all_except_self`: `DEINIT_VEC(store->instances, wasm_instance_vec_delete)` As the threads are joining they can call `wasm_interp_dump_call_stack` which tries to use the module frames but they were already freed by this line: `DEINIT_VEC(store->modules, wasm_module_vec_delete)` This PR swaps the order that these are deleted so module is deleted after the instances. Co-authored-by: Andrew Chambers <ncham@amazon.com>
1 parent b0736e2 commit 5aa22d4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

core/iwasm/common/wasm_c_api.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -687,8 +687,8 @@ wasm_store_delete(wasm_store_t *store)
687687
return;
688688
}
689689

690-
DEINIT_VEC(store->modules, wasm_module_vec_delete);
691690
DEINIT_VEC(store->instances, wasm_instance_vec_delete);
691+
DEINIT_VEC(store->modules, wasm_module_vec_delete);
692692
if (store->foreigns) {
693693
bh_vector_destroy(store->foreigns);
694694
wasm_runtime_free(store->foreigns);

0 commit comments

Comments
 (0)