Fixed clientprefs prefab menu double free crash (bug 5374, r=asherkin).
authorNicholas Hastings <skamonkey@gmail.com>
Tue Jul 03 07:51:12 2012 -0400 (2012-07-03)
changeset 3573440c51204096
parent 3572 a3b3cb039d7a
child 3574 b51285ca203f
Fixed clientprefs prefab menu double free crash (bug 5374, r=asherkin).
extensions/clientprefs/extension.cpp
extensions/clientprefs/extension.h
extensions/clientprefs/menus.cpp
     1.1 --- a/extensions/clientprefs/extension.cpp	Mon Jul 02 23:27:22 2012 -0400
     1.2 +++ b/extensions/clientprefs/extension.cpp	Tue Jul 03 07:51:12 2012 -0400
     1.3 @@ -105,6 +105,7 @@
     1.4  
     1.5  	sharesys->AddNatives(myself, g_ClientPrefNatives);
     1.6  	sharesys->RegisterLibrary(myself, "clientprefs");
     1.7 +	identity = sharesys->CreateIdentity(sharesys->CreateIdentType("ClientPrefs"), this);
     1.8  	g_CookieManager.cookieDataLoadedForward = forwards->CreateForward("OnClientCookiesCached", ET_Ignore, 1, NULL, Param_Cell);
     1.9  
    1.10  	g_CookieType = handlesys->CreateType("Cookie", 
    1.11 @@ -124,7 +125,7 @@
    1.12  		NULL);
    1.13  
    1.14  	IMenuStyle *style = menus->GetDefaultStyle();
    1.15 -	g_CookieManager.clientMenu = style->CreateMenu(&g_Handler, NULL);
    1.16 +	g_CookieManager.clientMenu = style->CreateMenu(&g_Handler, identity);
    1.17  	g_CookieManager.clientMenu->SetDefaultTitle("Client Settings:");
    1.18  
    1.19  	plsys->AddPluginsListener(&g_CookieManager);
    1.20 @@ -191,10 +192,17 @@
    1.21  
    1.22  	forwards->ReleaseForward(g_CookieManager.cookieDataLoadedForward);
    1.23  
    1.24 -	g_CookieManager.clientMenu->Destroy();
    1.25 +	HandleSecurity sec = HandleSecurity(identity, identity);
    1.26 +	HandleError err = handlesys->FreeHandle(g_CookieManager.clientMenu->GetHandle(), &sec);
    1.27 +	if (HandleError_None != err)
    1.28 +	{
    1.29 +		g_pSM->LogError(myself, "Error %d when attempting to free client menu handle", err);
    1.30 +	}
    1.31  
    1.32  	phrases->Destroy();
    1.33  
    1.34 +	sharesys->DestroyIdentity( identity );
    1.35 +
    1.36  	plsys->RemovePluginsListener(&g_CookieManager);
    1.37  	playerhelpers->RemoveClientListener(&g_CookieManager);
    1.38  
    1.39 @@ -470,6 +478,11 @@
    1.40  	return true;
    1.41  }
    1.42  
    1.43 +IdentityToken_t *ClientPrefs::GetIdentity() const
    1.44 +{
    1.45 +	return identity;
    1.46 +}
    1.47 +
    1.48  const char *ClientPrefs::GetExtensionVerString()
    1.49  {
    1.50  	return SM_FULL_VERSION;
     2.1 --- a/extensions/clientprefs/extension.h	Mon Jul 02 23:27:22 2012 -0400
     2.2 +++ b/extensions/clientprefs/extension.h	Tue Jul 03 07:51:12 2012 -0400
     2.3 @@ -141,6 +141,8 @@
     2.4  	//virtual bool SDK_OnMetamodPauseChange(bool paused, char *error, size_t maxlength);
     2.5  #endif
     2.6  public:
     2.7 +	IdentityToken_t *GetIdentity() const;
     2.8 +public:
     2.9  	IDBDriver *Driver;
    2.10  	IDatabase *Database;
    2.11  	bool databaseLoading;
    2.12 @@ -152,6 +154,7 @@
    2.13  private:
    2.14  	SourceHook::List<TQueryOp *> cachedQueries;
    2.15  	IMutex *queryMutex;
    2.16 +	IdentityToken_t *identity;
    2.17  };
    2.18  
    2.19  class CookieTypeHandler : public IHandleTypeDispatch
     3.1 --- a/extensions/clientprefs/menus.cpp	Mon Jul 02 23:27:22 2012 -0400
     3.2 +++ b/extensions/clientprefs/menus.cpp	Tue Jul 03 07:51:12 2012 -0400
     3.3 @@ -57,7 +57,7 @@
     3.4  		return;
     3.5  	}
     3.6  
     3.7 -	IBaseMenu *submenu = menus->GetDefaultStyle()->CreateMenu(&g_AutoHandler, NULL);
     3.8 +	IBaseMenu *submenu = menus->GetDefaultStyle()->CreateMenu(&g_AutoHandler, g_ClientPrefs.GetIdentity());
     3.9  
    3.10  	char message[256];
    3.11  
    3.12 @@ -175,5 +175,10 @@
    3.13  
    3.14  void AutoMenuHandler::OnMenuEnd(IBaseMenu *menu, MenuEndReason reason)
    3.15  {
    3.16 -	menu->Destroy(true);
    3.17 +	HandleSecurity sec = HandleSecurity(g_ClientPrefs.GetIdentity(), g_ClientPrefs.GetIdentity());
    3.18 +	HandleError err = handlesys->FreeHandle(menu->GetHandle(), &sec);
    3.19 +	if (HandleError_None != err)
    3.20 +	{
    3.21 +		g_pSM->LogError(myself, "Error %d when attempting to free automenu handle", err);
    3.22 +	}
    3.23  }