Bugfix: reference counting was accessing freed memory

alranel · alranel · commit d7f20e31af2e · 2022-05-12T13:44:25.000+02:00
diff --git a/src/local/BLELocalAttribute.cpp b/src/local/BLELocalAttribute.cpp
@@ -19,9 +19,10 @@
 
 #include "BLELocalAttribute.h"
 
+std::map<BLELocalAttribute*,int> BLELocalAttribute::_refCount;
+
 BLELocalAttribute::BLELocalAttribute(const char* uuid) :
-  _uuid(uuid),
-  _refCount(0)
+  _uuid(uuid)
 {
 }
 
@@ -51,14 +52,15 @@ enum BLEAttributeType BLELocalAttribute::type() const
 
 int BLELocalAttribute::retain()
 {
-  _refCount++;
+  _refCount[this]++;
 
-  return _refCount;
+  return _refCount[this];
 }
 
 int BLELocalAttribute::release()
 {
-  _refCount--;
+  _refCount[this]--;
+  if (_refCount[this] == 0) _refCount.erase(this);
 
-  return _refCount;
+  return _refCount[this];
 }
diff --git a/src/local/BLELocalAttribute.h b/src/local/BLELocalAttribute.h
@@ -22,6 +22,8 @@
 
 #include "utility/BLEUuid.h"
 
+#include <map>
+
 #define BLE_ATTRIBUTE_TYPE_SIZE 2
 
 enum BLEAttributeType {
@@ -54,7 +56,7 @@ class BLELocalAttribute
 
 private:
   BLEUuid _uuid;
-  int _refCount;
+  static std::map<BLELocalAttribute*,int> _refCount;
 };
 
 #endif
diff --git a/src/remote/BLERemoteAttribute.cpp b/src/remote/BLERemoteAttribute.cpp
@@ -21,9 +21,10 @@
 
 #include "BLERemoteAttribute.h"
 
+std::map<BLERemoteAttribute*,int> BLERemoteAttribute::_refCount;
+
 BLERemoteAttribute::BLERemoteAttribute(const uint8_t uuid[], uint8_t uuidLen) :
-  _uuid(BLEUuid::uuidToString(uuid, uuidLen)),
-  _refCount(0)
+  _uuid(BLEUuid::uuidToString(uuid, uuidLen))
 {
 }
 
@@ -38,14 +39,15 @@ const char* BLERemoteAttribute::uuid() const
 
 int BLERemoteAttribute::retain()
 {
-  _refCount++;
+  _refCount[this]++;
 
-  return _refCount;
+  return _refCount[this];
 }
 
 int BLERemoteAttribute::release()
 {
-  _refCount--;
+  _refCount[this]--;
+  if (_refCount[this] == 0) _refCount.erase(this);
 
-  return _refCount;
+  return _refCount[this];
 }
diff --git a/src/remote/BLERemoteAttribute.h b/src/remote/BLERemoteAttribute.h
@@ -21,6 +21,7 @@
 #define _BLE_REMOTE_ATTRIBUTE_H_
 
 #include <Arduino.h>
+#include <map>
 
 class BLERemoteAttribute
 {
@@ -35,7 +36,7 @@ class BLERemoteAttribute
 
 private:
   String _uuid;
-  int _refCount;
+  static std::map<BLERemoteAttribute*,int> _refCount;
 };
 
 #endif

Original file line number	Diff line number	Diff line change
`@@ -19,9 +19,10 @@`
`19`	`19`
`20`	`20`	`#include "BLELocalAttribute.h"`
`21`	`21`
	`22`	`+std::map<BLELocalAttribute*,int> BLELocalAttribute::_refCount;`
	`23`	`+`
`22`	`24`	`BLELocalAttribute::BLELocalAttribute(const char* uuid) :`
`23`		`- _uuid(uuid),`
`24`		`- _refCount(0)`
	`25`	`+ _uuid(uuid)`
`25`	`26`	`{`
`26`	`27`	`}`
`27`	`28`
`@@ -51,14 +52,15 @@ enum BLEAttributeType BLELocalAttribute::type() const`
`51`	`52`
`52`	`53`	`int BLELocalAttribute::retain()`
`53`	`54`	`{`
`54`		`- _refCount++;`
	`55`	`+ _refCount[this]++;`
`55`	`56`
`56`		`- return _refCount;`
	`57`	`+ return _refCount[this];`
`57`	`58`	`}`
`58`	`59`
`59`	`60`	`int BLELocalAttribute::release()`
`60`	`61`	`{`
`61`		`- _refCount--;`
	`62`	`+ _refCount[this]--;`
	`63`	`+ if (_refCount[this] == 0) _refCount.erase(this);`
`62`	`64`
`63`		`- return _refCount;`
	`65`	`+ return _refCount[this];`
`64`	`66`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,9 +21,10 @@`
`21`	`21`
`22`	`22`	`#include "BLERemoteAttribute.h"`
`23`	`23`
	`24`	`+std::map<BLERemoteAttribute*,int> BLERemoteAttribute::_refCount;`
	`25`	`+`
`24`	`26`	`BLERemoteAttribute::BLERemoteAttribute(const uint8_t uuid[], uint8_t uuidLen) :`
`25`		`- _uuid(BLEUuid::uuidToString(uuid, uuidLen)),`
`26`		`- _refCount(0)`
	`27`	`+ _uuid(BLEUuid::uuidToString(uuid, uuidLen))`
`27`	`28`	`{`
`28`	`29`	`}`
`29`	`30`
`@@ -38,14 +39,15 @@ const char* BLERemoteAttribute::uuid() const`
`38`	`39`
`39`	`40`	`int BLERemoteAttribute::retain()`
`40`	`41`	`{`
`41`		`- _refCount++;`
	`42`	`+ _refCount[this]++;`
`42`	`43`
`43`		`- return _refCount;`
	`44`	`+ return _refCount[this];`
`44`	`45`	`}`
`45`	`46`
`46`	`47`	`int BLERemoteAttribute::release()`
`47`	`48`	`{`
`48`		`- _refCount--;`
	`49`	`+ _refCount[this]--;`
	`50`	`+ if (_refCount[this] == 0) _refCount.erase(this);`
`49`	`51`
`50`		`- return _refCount;`
	`52`	`+ return _refCount[this];`
`51`	`53`	`}`