search

transmission / transmission

Official Transmission BitTorrent client repository
https://transmissionbt.com
Other
11.67k stars 1.18k forks source link

fix: crash in `tr_torrent::VerifyMediator::on_verify_done()` #6918

Open tearfur opened 1 week ago

tearfur commented 1 week ago

The crash will happen if the following series of events happened:

  1. Torrent verification starts for a tr_torrent object.
  2. The session thread starts executing tr_torrentFreeInSessionThread(), about to free this tr_torrent object.
  3. tr_torrent::VerifyMediator::on_verify_done() queues a lambda that captures a pointer to the tr_torrent object.
  4. The tr_torrent object is freed.
  5. The session thread executes the lambda from Step 3, and crashes when dereferencing the dangling tr_torrent pointer.

I think this fixes the recent CI crashes in LT.TorrentMagnetTest.setMetadataPiece, such as this one https://github.com/transmission/transmission/pull/6665#issuecomment-2132217599.