ACE_Refcounted_Auto_Ptr_Rep pointer assignment to "NULL" or "0"

[ashaikh111]

ACE version 6.3.4

Hi,
I am new to ACE,
In the following code block, why "rep" is not assigned with "NULL" or "0" after deleting it.
is it bug, that it is not assigned with "NULL" or "0" ?

template <class X, class ACE_LOCK> inline void
ACE_Refcounted_Auto_Ptr_Rep<X, ACE_LOCK>::detach (ACE_Refcounted_Auto_Ptr_Rep<X, ACE_LOCK>*& rep)
{
if (rep == 0)
return;

if (rep->ref_count_-- == 0) {
delete rep;
}

[iguessthislldo]

I'm not familiar with this class at all, so I might be wrong about this, but here are the places I could find that use detach:

ACE_TAO/ACE/ace/Refcounted_Auto_Ptr.inl

Lines 143 to 144 in 1522d0f

	AUTO_REFCOUNTED_PTR_REP::detach (this->rep_);
	this->rep_ = 0;

ACE_TAO/ACE/ace/Refcounted_Auto_Ptr.inl

Lines 178 to 179 in 1522d0f

	AUTO_REFCOUNTED_PTR_REP::detach (old_rep);
	this->rep_ = 0;

In these two uses it sets to null after detach like it should.

ACE_TAO/ACE/ace/Refcounted_Auto_Ptr.inl

Lines 156 to 160 in 1522d0f

	AUTO_REFCOUNTED_PTR_REP *old_rep = this->rep_;
	if ((this->rep_ = AUTO_REFCOUNTED_PTR_REP::create (p)) != 0)
	AUTO_REFCOUNTED_PTR_REP::detach (old_rep);
	else
	this->rep_ = old_rep;

ACE_TAO/ACE/ace/Refcounted_Auto_Ptr.inl

Lines 171 to 174 in 1522d0f

	this->rep_ = AUTO_REFCOUNTED_PTR_REP::attach
	(const_cast<ACE_Refcounted_Auto_Ptr<X, ACE_LOCK>& > (rhs).rep_);
	if (this->rep_ != 0)
	AUTO_REFCOUNTED_PTR_REP::detach (old_rep);

In these two cases it's replacing the pointer so it doesn't matter what it does with the old pointer value. Assuming it's not used again.

ACE_TAO/ACE/ace/Refcounted_Auto_Ptr.cpp

Lines 11 to 15 in 1522d0f

	template <class X, class ACE_LOCK>
	ACE_Refcounted_Auto_Ptr<X, ACE_LOCK>::~ACE_Refcounted_Auto_Ptr ()
	{
	AUTO_REFCOUNTED_PTR_REP::detach (rep_);
	}

Here the object is going away so it doesn't really matter either.

So it looks like it's not nulling the value just because it doesn't always strictly have to. I do admit it would be the safe thing to do though.

Do you see a use-after-free issue with this or is this just a question?

[ashaikh111]

Thanks Fred for the reply.
I am using ACE library in my one of the applications, which is crashing at client side. When I open crash dump in visual studio 2015 then it shows control at following statement:
if (rep->ref_count_-- == 0) {
So, I am trying to understand, why "0" or NULL is not assigned to it immediately in the same function I.e. in "Detach" and "0" is assigned out side this method. Why it is kept dangling? I am trying to understand purpose. If we don't assign "0" after free then, is it unsafe?