Skip to content

Commit 15cf72b

Browse files
committed
[sourcekit] Fix use-after-free of block inside libsourcekitdInProc sync_request
In sourcekitdInProc, we were doing a by-ref capture of a block that didn't live as long as the asyncronous callback. Fix it by capturing by-copy. Found by ASan!
1 parent 32db8f7 commit 15cf72b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tools/SourceKit/tools/sourcekitd/bin/InProc/sourcekitdInProc.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ void sourcekitd_send_request(sourcekitd_object_t req,
123123
sourcekitd_request_retain(req);
124124
receiver = Block_copy(receiver);
125125
WorkQueue::dispatchConcurrent([=]{
126-
sourcekitd::handleRequest(req, [&](sourcekitd_response_t resp) {
126+
sourcekitd::handleRequest(req, [=](sourcekitd_response_t resp) {
127127
// The receiver accepts ownership of the response.
128128
receiver(resp);
129129
Block_release(receiver);

0 commit comments

Comments
 (0)