Re: Bugs in class Thread. The Pointer to a deleted resource must be set to 0

[David Sugar]

The case of delete priv, yes, priv must be set to NULL after it is deleted!  
This was fixed in 1.1 sf cvs last night.  The other two cases involve 
pointers held/copied into temporary local variables, so it's irrelivent if 
the temporary local copies of the pointer are NULL'd right before the return.

On Friday 19 December 2003 09:38 am, Tobias Erbsland wrote:
> Hello
>
> There are some bugs the the class Thread. I found the first example in
> DummyThread. Code snipplet:
>
> void DummyThread::CheckDelete()
> {
>       Thread *th = (Thread*)_self.getKey();
>       if (!th) return;
>
>       // delete if dummy thread
>       if (th->priv->_type == threadTypeDummy)
>               delete th;
> }
>
> I could be that the dummy thread is deleted multible times.
> The function should be:
>
> void DummyThread::CheckDelete()
> {
>       Thread *th = (Thread*)_self.getKey();
>       if (!th) return;
>
>       // delete if dummy thread
>       if (th->priv->_type == threadTypeDummy)
>       {
>               delete th;
>               th = 0; // <---------- !!!
>       }
> }
>
> The same fault in the function "terminate()":
>
> void Thread::terminate(void)
> {
> #ifdef WIN32
>       if(!priv)
>               return;
>
>       if (!priv->_tid || isThread())
>               return;
> // (....)
>       delete priv;
> }
>
> first call of terminate deletes the resouce pointed by priv. Second call
> crashes, because the pointer sill points to the deleted resource:
>
>       delete priv;
>       priv = 0; // <---!!!
> }
>
> solves this problem.
> Same Problem again:
>
> // delete Thread class created for no CommonC++ thread
> inline void ThreadImpl::ThreadDestructor(Thread* th)
> {
>       if (!th || th == DUMMY_INVALID_THREAD)
>               return;
>       if (th->priv->_type == threadTypeDummy)
>               delete th;
> }
>
> Same problems in the class Poller also.
>
> regards
> Tobias