dechamps / FlexASIO

A flexible universal ASIO driver that uses the PortAudio sound I/O library. Supports WASAPI (shared and exclusive), KS, DirectSound and MME.
Other
1.35k stars 72 forks source link

Use-after-free bug in FlexASIO config watcher cleanup code #209

Closed dechamps closed 4 months ago

dechamps commented 8 months ago

flexasio::ConfigLoader::Watcher sets up a ReadDirectoryChangesW overlapped I/O, but then never cancels it, even when the Watcher is being destroyed.

This can (and, in fact, probably will) result in ReadDirectoryChangesW writing to its buffer after it has been freed, potentially trampling over random data in application memory.

This will trigger memory corruption and undefined behavior with unpredictable consequences. The more often the application disposes FlexASIO buffers (which triggers config watcher cleanup), the more likely something bad will happen. In contrast, applications that dispose FlexASIO buffers only once right before exiting would be unlikely to show any symptoms.

It is possible this may be the root cause of #208.

The fix would be to call CancelIo() on the ReadDirectoryChangesW overlapped I/O and then wait for the I/O to complete before returning from the Watcher destructor. I suspect this might end up making the code simpler as there wouldn't be a need for a separate clean up event - the cancellation signals cleanup.

dechamps commented 4 months ago

This is fixed in FlexASIO 1.10.