Skip to content

Commit f21f8d6

Browse files
committed
Fix crash due to freeing elements of m_serialDequeue twice.
In Profiler::DequeueSerial if AppendData fails part way through m_serialDequeue then the elements could be freed again in Profiler::ClearSerial, which leads to memory corruption in rpmalloc.
1 parent 6e214ca commit f21f8d6

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

‎public/client/TracyProfiler.cpp‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2846,6 +2846,8 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
28462846
}
28472847
}
28482848

2849+
DequeueStatus dequeueStatus = DequeueStatus::QueueEmpty;
2850+
28492851
const auto sz = m_serialDequeue.size();
28502852
if( sz > 0 )
28512853
{
@@ -3145,7 +3147,10 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
31453147
}
31463148
}
31473149
#endif
3148-
if( !AppendData( item, QueueDataSize[idx] ) ) return DequeueStatus::ConnectionLost;
3150+
if(dequeueStatus != DequeueStatus::ConnectionLost && !AppendData( item, QueueDataSize[idx] ) )
3151+
{
3152+
dequeueStatus = DequeueStatus::ConnectionLost;
3153+
}
31493154
item++;
31503155
}
31513156
m_refTimeSerial = refSerial;
@@ -3155,11 +3160,7 @@ Profiler::DequeueStatus Profiler::DequeueSerial()
31553160
#endif
31563161
m_serialDequeue.clear();
31573162
}
3158-
else
3159-
{
3160-
return DequeueStatus::QueueEmpty;
3161-
}
3162-
return DequeueStatus::DataDequeued;
3163+
return dequeueStatus;
31633164
}
31643165

31653166
Profiler::ThreadCtxStatus Profiler::ThreadCtxCheck( uint32_t threadId )

0 commit comments

Comments
 (0)