Relintai/sdl2_frt
1
0
Fork 0
mirror of https://github.com/Relintai/sdl2_frt.git synced 2024-12-16 11:06:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free SBH corruption due to overlapped ReadFile in hidapi not being canceled for all threads before device close

Browse Source 
- hidapi already called CancelIo on hid_close but that only cancels pending IO for the current thread. Controller read/writes originate from multiple
  threads (serialized, but on a different thread nonetheless) but device destruction was always done on the main device thread which left any
  pending overlapped reads still running after hidapi's internal read buffer is deallocated leading to intermittent free list corruption.
This commit is contained in:
Sam Lantinga 2021-01-01 11:12:41 -08:00
parent 480c1f9fef
commit ab55ec4850
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/hidapi/windows/hid.c
View File

@ -932,9 +932,13 @@ int HID_API_EXPORT HID_API_CALL hid_get_feature_report(hid_device *dev, unsigned
void HID_API_EXPORT HID_API_CALL hid_close(hid_device *dev)
{
DWORD bytes_read = 0;
if (!dev)
return;
CancelIo(dev->device_handle);
CancelIoEx(dev->device_handle, NULL);
if (dev->read_pending)
GetOverlappedResult(dev->device_handle, &dev->ol, &bytes_read, TRUE/*wait*/);
free_hid_device(dev);
}