Skip to content

Commit

Permalink
n-api: fix use-after-free with napi_remove_async_cleanup_hook
Browse files Browse the repository at this point in the history
Fixes: #34657
Refs: #34572

PR-URL: #34662
Reviewed-By: Gabriel Schulhof <[email protected]>
Reviewed-By: James M Snell <[email protected]>
  • Loading branch information
addaleax committed Aug 8, 2020
1 parent 6502489 commit fbd411d
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/node_api.cc
Original file line number Diff line number Diff line change
Expand Up @@ -533,6 +533,7 @@ napi_status napi_add_async_cleanup_hook(
auto handle = node::AddEnvironmentCleanupHook(env->isolate, fun, arg);
if (remove_handle != nullptr) {
*remove_handle = new napi_async_cleanup_hook_handle__ { std::move(handle) };
env->Ref();
}

return napi_clear_last_error(env);
Expand All @@ -547,6 +548,11 @@ napi_status napi_remove_async_cleanup_hook(
node::RemoveEnvironmentCleanupHook(std::move(remove_handle->handle));
delete remove_handle;

// Release the `env` handle asynchronously since it would be surprising if
// a call to a N-API function would destroy `env` synchronously.
static_cast<node_napi_env>(env)->node_env()
->SetImmediate([env](node::Environment*) { env->Unref(); });

return napi_clear_last_error(env);
}

Expand Down

0 comments on commit fbd411d

Please sign in to comment.