-
- Downloads
BugID: 905
- There turned out to be situation where calling decrNParents() in the destuctor of MeqExprRep on its children would result in an invalid read. For instance, MeqLMN has two MeqExpr attributes itsRa, itsDec. When a MeqLMN node is destructed, these attributes are deleted and then the destructor of the base class MeqExprRep is called. Now if deleted of itsRa, itsDec brings their reference count to zero, these nodes are destructed and the subsequent call to decrNParents from the destructor of MeqExprRep called by the destructor of MeqLMN results in an invalid read. The reason that a MeqExprRep can still have a link to a child that has already been destructed is that its child vector consists of MeqExprRep* instead of the reference counted MeqExpr. In other words, MeqExprRep::addChild() does not result in an increment of the reference count. This was fixed by replacing the child vector with a vector of MeqExpr.
Showing
- CEP/BB/BBSKernel/include/BBSKernel/MNS/MeqExpr.h 37 additions, 9 deletionsCEP/BB/BBSKernel/include/BBSKernel/MNS/MeqExpr.h
- CEP/BB/BBSKernel/src/MNS/MeqExpr.cc 19 additions, 17 deletionsCEP/BB/BBSKernel/src/MNS/MeqExpr.cc
- CEP/BB/BBSKernel/src/MNS/MeqExpr.h 37 additions, 9 deletionsCEP/BB/BBSKernel/src/MNS/MeqExpr.h
Loading
Please register or sign in to comment