Fix narrow use-after-free races in OpenSlideFFM

When OpenSlide returns a pointer to a structure inside the openslide_t, we
need to hold the OpenSlideRef lock until we're done copying out the
returned data.  This prevents another thread from closing the openslide_t
out from under us.

Fixes: 6d10501 ("Push locking down into OpenSlideFFM")
Signed-off-by: Benjamin Gilbert <[email protected]>

Author: bgilbert

org/openslide/OpenSlideFFM.java

@@ -356,14 +356,16 @@ static void openslide_read_icc_profile(OpenSlideRef osr, byte dest[]) {
     static String openslide_get_error(OpenSlideRef osr) {
         MemorySegment ret;
         try (Ref.ScopedLock l = osr.lock()) {
-            ret = (MemorySegment) get_error.invokeExact(osr.getSegment());
-        } catch (Throwable ex) {
-            throw wrapException(ex);
-        }
-        if (ret.equals(MemorySegment.NULL)) {
-            return null;
+            try {
+                ret = (MemorySegment) get_error.invokeExact(osr.getSegment());
+            } catch (Throwable ex) {
+                throw wrapException(ex);
+            }
+            if (ret.equals(MemorySegment.NULL)) {
+                return null;
+            }
+            return ret.getString(0);
         }
-        return ret.getString(0);
     }
 
     private static final MethodHandle get_property_names = function(
@@ -372,29 +374,33 @@ static String openslide_get_error(OpenSlideRef osr) {
     static String[] openslide_get_property_names(OpenSlideRef osr) {
         MemorySegment ret;
         try (Ref.ScopedLock l = osr.lock()) {
-            ret = (MemorySegment) get_property_names.invokeExact(
-                    osr.getSegment());
-        } catch (Throwable ex) {
-            throw wrapException(ex);
+            try {
+                ret = (MemorySegment) get_property_names.invokeExact(
+                        osr.getSegment());
+            } catch (Throwable ex) {
+                throw wrapException(ex);
+            }
+            return segment_to_string_array(ret);
         }
-        return segment_to_string_array(ret);
     }
 
     private static final MethodHandle get_property_value = function(
             C_POINTER, "openslide_get_property_value", C_POINTER, C_POINTER);
 
     static String openslide_get_property_value(OpenSlideRef osr, String name) {
         MemorySegment ret;
-        try (Arena arena = Arena.ofConfined(); Ref.ScopedLock l = osr.lock()) {
-            ret = (MemorySegment) get_property_value.invokeExact(
-                    osr.getSegment(), arena.allocateFrom(name));
-        } catch (Throwable ex) {
-            throw wrapException(ex);
-        }
-        if (ret.equals(MemorySegment.NULL)) {
-            return null;
+        try (Ref.ScopedLock l = osr.lock()) {
+            try (Arena arena = Arena.ofConfined()) {
+                ret = (MemorySegment) get_property_value.invokeExact(
+                        osr.getSegment(), arena.allocateFrom(name));
+            } catch (Throwable ex) {
+                throw wrapException(ex);
+            }
+            if (ret.equals(MemorySegment.NULL)) {
+                return null;
+            }
+            return ret.getString(0);
         }
-        return ret.getString(0);
     }
 
     private static final MethodHandle get_associated_image_names = function(
@@ -403,12 +409,14 @@ static String openslide_get_property_value(OpenSlideRef osr, String name) {
     static String[] openslide_get_associated_image_names(OpenSlideRef osr) {
         MemorySegment ret;
         try (Ref.ScopedLock l = osr.lock()) {
-            ret = (MemorySegment) get_associated_image_names.invokeExact(
-                    osr.getSegment());
-        } catch (Throwable ex) {
-            throw wrapException(ex);
+            try {
+                ret = (MemorySegment) get_associated_image_names.invokeExact(
+                        osr.getSegment());
+            } catch (Throwable ex) {
+                throw wrapException(ex);
+            }
+            return segment_to_string_array(ret);
         }
-        return segment_to_string_array(ret);
     }
 
     private static final MethodHandle get_associated_image_dimensions = function(