From 93f3bd545b65a4df1ed04118f696a85a0e50c423 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Tue, 7 Jun 2016 14:57:43 +0200 Subject: unoxml: fix data race in CEventDispatcher::callListeners() JunitTest_unoxml_complex crashed with an assertion: error: attempt to increment a singular iterator. This is because the CEventDispatcher::dispatchEvent() attempts to copy the m_TargetListeners onto the stack, before dropping the mutex to call the, listeners, but the copy is unintentionally shallow and the ListenerMap that is the value of the outer type is not copied, so this member is accessed in callListeners() without MutexGuard. Fix this by replacing ListenerMap* with ListenerMap as the value, which also allows getting rid of explicit delete calls. 15 0x00002b7793e5ace8 in abort () at /lib64/libc.so.6 16 0x00002b77948c1565 in __gnu_debug::_Error_formatter::_M_error() const () at /lib64/libstdc++.so.6 17 0x00002b77b802a7d8 in __gnu_debug::_Safe_iterator > >, std::__debug::multimap<_xmlNode*, com::sun::star::uno::Reference, std::less<_xmlNode*>, std::allocator > > > >::operator++() (this=0x2b77b7d99c90) at /usr/include/c++/4.8.2/debug/safe_iterator.h:291 18 0x00002b77b80275ae in DOM::events::CEventDispatcher::callListeners(std::__debug::map, std::less<_xmlNode*>, std::allocator > > >*, std::less, std::allocator, std::less<_xmlNode*>, std::allocator > > >*> > > const&, _xmlNode*, rtl::OUString const&, com::sun::star::uno::Reference const&) (rTMap=std::__debug::map with 1 elements, pNode=0x21a9c10, aType=..., xEvent=...) at /unoxml/source/events/eventdispatcher.cxx:103 pMap = 0x2203b10 iter = {first = , second = { = {_pInterface = }, }} ibound = {first = , second = { = {_pInterface = }, }} tIter = {first = {pData = }, second = } 19 0x00002b77b80284e4 in DOM::events::CEventDispatcher::dispatchEvent(DOM::CDocument&, osl::Mutex&, _xmlNode*, com::sun::star::uno::Reference const&, com::sun::star::uno::Reference const&) const (this=0x21fbee0, rDocument=..., rMutex=..., pNode=0x2200890, xNode=..., i_xEvent=...) at /unoxml/source/events/eventdispatcher.cxx:242 captureListeners = std::__debug::map with 0 elements targetListeners = std::__debug::map with 1 elements = {[{pData = 0x2202a30}] = 0x2203b10} Change-Id: I66fb7a461df0f8066383365850536f7b0394306d --- unoxml/source/events/eventdispatcher.cxx | 34 +++++++++++++------------------- unoxml/source/events/eventdispatcher.hxx | 2 +- 2 files changed, 15 insertions(+), 21 deletions(-) (limited to 'unoxml') diff --git a/unoxml/source/events/eventdispatcher.cxx b/unoxml/source/events/eventdispatcher.cxx index 7fd7a48685c9..0dab5b9d0624 100644 --- a/unoxml/source/events/eventdispatcher.cxx +++ b/unoxml/source/events/eventdispatcher.cxx @@ -41,16 +41,16 @@ namespace DOM { namespace events { // get the multimap for the specified type ListenerMap *pMap = nullptr; - TypeListenerMap::const_iterator tIter = pTMap->find(aType); + auto tIter = pTMap->find(aType); if (tIter == pTMap->end()) { // the map has to be created - pMap = new ListenerMap(); - pTMap->insert(TypeListenerMap::value_type(aType, pMap)); + auto const pair = pTMap->insert(TypeListenerMap::value_type(aType, ListenerMap())); + pMap = & pair.first->second; } else { - pMap = tIter->second; + pMap = & tIter->second; } - if (pMap !=nullptr) - pMap->insert(ListenerMap::value_type(pNode, aListener)); + assert(pMap != nullptr); + pMap->insert(ListenerMap::value_type(pNode, aListener)); } void CEventDispatcher::removeListener(xmlNodePtr pNode, const OUString& aType, const Reference& aListener, bool bCapture) @@ -59,19 +59,19 @@ namespace DOM { namespace events { ? (& m_CaptureListeners) : (& m_TargetListeners); // get the multimap for the specified type - TypeListenerMap::const_iterator tIter = pTMap->find(aType); + auto tIter = pTMap->find(aType); if (tIter != pTMap->end()) { - ListenerMap *pMap = tIter->second; + ListenerMap & rMap = tIter->second; // find listeners of specified type for specified node - ListenerMap::iterator iter = pMap->find(pNode); - while (iter != pMap->end() && iter->first == pNode) + ListenerMap::iterator iter = rMap.find(pNode); + while (iter != rMap.end() && iter->first == pNode) { // erase all references to specified listener if ((iter->second).is() && iter->second == aListener) { ListenerMap::iterator tmp_iter = iter; ++iter; - pMap->erase(tmp_iter); + rMap.erase(tmp_iter); } else ++iter; @@ -81,12 +81,6 @@ namespace DOM { namespace events { CEventDispatcher::~CEventDispatcher() { - // delete the multimaps for the various types - for (TypeListenerMap::iterator aI = m_CaptureListeners.begin(); aI != m_CaptureListeners.end(); ++aI) - delete aI->second; - - for (TypeListenerMap::iterator aI = m_TargetListeners.begin(); aI != m_TargetListeners.end(); ++aI) - delete aI->second; } void CEventDispatcher::callListeners( @@ -97,9 +91,9 @@ namespace DOM { namespace events { // get the multimap for the specified type TypeListenerMap::const_iterator tIter = rTMap.find(aType); if (tIter != rTMap.end()) { - ListenerMap *pMap = tIter->second; - ListenerMap::const_iterator iter = pMap->lower_bound(pNode); - ListenerMap::const_iterator ibound = pMap->upper_bound(pNode); + ListenerMap const& rMap = tIter->second; + auto iter = rMap.lower_bound(pNode); + auto const ibound = rMap.upper_bound(pNode); for( ; iter != ibound; ++iter ) { if((iter->second).is()) diff --git a/unoxml/source/events/eventdispatcher.hxx b/unoxml/source/events/eventdispatcher.hxx index d8703ac1bba6..d992ff30d8d3 100644 --- a/unoxml/source/events/eventdispatcher.hxx +++ b/unoxml/source/events/eventdispatcher.hxx @@ -42,7 +42,7 @@ class CDocument; namespace events { typedef std::multimap< xmlNodePtr, css::uno::Reference< css::xml::dom::events::XEventListener> > ListenerMap; -typedef std::map< OUString, ListenerMap*> TypeListenerMap; +typedef std::map TypeListenerMap; class CEventDispatcher { -- cgit