fix(coro): fix read-after-free in dpp::async

brainboxdotcc · Jul 6, 2024 · fb59bba · fb59bba
1 parent 69dd902
commit fb59bba
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/include/dpp/coro/async.h b/include/dpp/coro/async.h
@@ -134,6 +134,16 @@ class async : public awaitable<R> {
 	explicit async(Fun &&fun, Args&&... args) : async{std::make_shared<basic_promise<R>>()} {
 		std::invoke(std::forward<Fun>(fun), std::forward<Args>(args)..., api_callback);
 	}
+
+	async(const async&) = delete;
+	async(async&&) = default;
+
+	async& operator=(const async&) = delete;
+	async& operator=(async&&) = default;
+
+	~async() {
+		this->abandon();
+	}
 };
 
 DPP_CHECK_ABI_COMPAT(async<>, async_dummy);

diff --git a/include/dpp/coro/awaitable.h b/include/dpp/coro/awaitable.h
@@ -638,8 +638,11 @@ using promise = moveable_promise<T>;
 
 template <typename T>
 auto awaitable<T>::abandon() -> uint8_t {
-	auto previous_state = state_ptr->state.fetch_or(state_flags::sf_broken, std::memory_order::acq_rel);
-	state_ptr = nullptr;
+	uint8_t previous_state = state_flags::sf_broken;
+	if (state_ptr) {
+		previous_state = state_ptr->state.fetch_or(state_flags::sf_broken, std::memory_order::acq_rel);
+		state_ptr = nullptr;
+	}
 	return previous_state;
 }