dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Tests: Add a test to check for UAF on the Unix event loop's thread data

Browse source
This commit is contained in:
Zaggy1024 2026-02-27 06:46:27 -06:00 committed by Gregory Bertilson
parent 035b489266
commit 567ba4d0ad
2 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibCore/CMakeLists.txt
View file

@ -28,4 +28,5 @@ if(NOT WIN32)
set_tests_properties(TestLibCoreMappedFile TestLibCoreStream PROPERTIES WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
endif()
target_link_libraries(TestLibCoreEventLoop PRIVATE LibThreading)
target_link_libraries(TestLibCoreSharedSingleProducerCircularQueue PRIVATE LibThreading)

29
Tests/LibCore/TestLibCoreEventLoop.cpp
View file

@ -4,8 +4,10 @@
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/OwnPtr.h>
#include <LibCore/EventLoop.h>
#include <LibTest/TestCase.h>
#include <LibThreading/Thread.h>
TEST_CASE(test_poll_for_events)
{
@ -13,3 +15,30 @@ TEST_CASE(test_poll_for_events)
event_loop.pump(Core::EventLoop::WaitMode::PollForEvents);
}
// Simulate the condition that occurs during exit(): ThreadData (thread-local) is destroyed
// while the EventLoop (normally stack-allocated) is still alive. Another thread holding a
// WeakEventLoopReference can then call wake(), which must handle the closed pipe FD gracefully.
TEST_CASE(wake_after_thread_exit)
{
Core::EventLoop main_loop;
IGNORE_USE_IN_ESCAPING_LAMBDA OwnPtr<Core::EventLoop> worker_loop;
IGNORE_USE_IN_ESCAPING_LAMBDA RefPtr<Core::WeakEventLoopReference> weak_ref;
auto thread = Threading::Thread::construct("Worker"sv, [&] {
worker_loop = make<Core::EventLoop>();
weak_ref = Core::EventLoop::current_weak();
return 0;
});
thread->start();
MUST(thread->join());
{
auto strong = weak_ref->take();
if (strong)
strong->wake();
}
worker_loop.clear();
}