Skip to content

W
wine-cw
Commit 39fea6cd authored by Rémi Bernon's avatar Rémi Bernon Committed by Alexandre Julliard
Browse files
Options

win32u: Guard font unused_entry against race condition.

There is a race condition otherwise between release_gdi_font and find_cached_gdi_font, leading to invalid memory access: One thread calling release_gdi_font may decrement refcount to 0, then try to enter font_lock. At the same time, another thread may be calling find_cached_gdi_font through select_font, holding the font_lock. This second thread would find refcount set to 0, and then try to remove unused_entry from its list, although it hasn't been added yet to the unused list. Signed-off-by: 's avatarRémi Bernon <rbernon@codeweavers.com> Signed-off-by: 's avatarHuw Davies <huw@codeweavers.com> Signed-off-by: 's avatarAlexandre Julliard <julliard@winehq.org>
parent 162991a0
Hide whitespace changes
Inline Side-by-side
Showing with 11 additions and 9 deletions
dlls/win32u/font.c
View file @ 39fea6cd
......@@ -2576,22 +2576,24 @@ static struct gdi_font *find_cached_gdi_font( const LOGFONTW *lf, const FMAT2 *m
static void release_gdi_font( struct gdi_font *font )
{
if (!font) return;
if (--font->refcount) return;
TRACE( "font %p\n", font );
/* add it to the unused list */
pthread_mutex_lock( &font_lock );
list_add_head( &unused_gdi_font_list, &font->unused_entry );
if (unused_font_count > UNUSED_CACHE_SIZE)
if (!--font->refcount)
{
font = LIST_ENTRY( list_tail( &unused_gdi_font_list ), struct gdi_font, unused_entry );
TRACE( "freeing %p\n", font );
list_remove( &font->entry );
list_remove( &font->unused_entry );
free_gdi_font( font );
list_add_head( &unused_gdi_font_list, &font->unused_entry );
if (unused_font_count > UNUSED_CACHE_SIZE)
{
font = LIST_ENTRY( list_tail( &unused_gdi_font_list ), struct gdi_font, unused_entry );
TRACE( "freeing %p\n", font );
list_remove( &font->entry );
list_remove( &font->unused_entry );
free_gdi_font( font );
}
else unused_font_count++;
}
else unused_font_count++;
pthread_mutex_unlock( &font_lock );
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment