Fix cross-heap free of userSuppliedTag in JniUtils::toTag - #368
Open
wonhong-choi wants to merge 1 commit into
Open
Fix cross-heap free of userSuppliedTag in JniUtils::toTag#368wonhong-choi wants to merge 1 commit into
wonhong-choi wants to merge 1 commit into
Conversation
The previous implementation allocated a buffer with `new jbyte[size]` (RTI DLL heap) and then discarded the pointer returned by GetByteArrayElements, passing the unrelated `new[]` pointer to ReleaseByteArrayElements instead. This caused the JVM to free a block from the wrong heap, resulting in STATUS_HEAP_CORRUPTION (0xC0000374) on every reflectAttributeValues/receiveInteraction/removeObjectInstance callback that carried a non-null userSuppliedTag. Additionally, because GetByteArrayElements' return value was thrown away, buffer held uninitialized memory and the received tag bytes were never actually read. Fix: capture the pointer GetByteArrayElements returns, build VariableLengthData from that pointer, then release that same pointer with JNI_ABORT. This matches the already-correct pattern used by toAttributeValueMap/toParameterValueMap in the same file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
Looks good to me thanks @wonhong-choi, thanks for your contribution! @timpokorny this should also get cherry-picked to master? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous implementation allocated a buffer with
new jbyte[size](RTI DLL heap) and then discarded the pointer returned by GetByteArrayElements, passing the unrelatednew[]pointer to ReleaseByteArrayElements instead. This caused the JVM to free a block from the wrong heap, resulting in STATUS_HEAP_CORRUPTION (0xC0000374) on every reflectAttributeValues/receiveInteraction/removeObjectInstance callback that carried a non-null userSuppliedTag.Additionally, because GetByteArrayElements' return value was thrown away, buffer held uninitialized memory and the received tag bytes were never actually read.
Fix: capture the pointer GetByteArrayElements returns, build VariableLengthData from that pointer, then release that same pointer with JNI_ABORT. This matches the already-correct pattern used by toAttributeValueMap/toParameterValueMap in the same file.