Fix UB when using prefix_and_tail

(cherry picked from commit 68aed3b)
zeek · Dec 4, 2023 · 4c3f803 · 4c3f803
1 parent 4f580d8
commit 4c3f803
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/libcaf_core/caf/flow/op/from_steps.hpp b/libcaf_core/caf/flow/op/from_steps.hpp
@@ -214,6 +214,9 @@ class from_steps_sub : public detail::plain_ref_counted,
         buf_.pop_front();
         --demand_;
         out_.on_next(item);
+        // Note: on_next() may call dispose() and set out_ to nullptr.
+        if (!out_)
+          return;
       }
       if (in_) {
         pull();

diff --git a/libcaf_core/caf/flow/op/prefix_and_tail.hpp b/libcaf_core/caf/flow/op/prefix_and_tail.hpp
@@ -121,7 +121,7 @@ class prefix_and_tail_sub : public detail::plain_ref_counted,
   }
 
   void request(size_t demand) override {
-    // Only called by the out_, never by the sink_. The latter triggers
+    // Only called by out_, never by sink_ (triggers on_sink_demand_change()).
     prefix_demand_ += demand;
     if (sub_ && !requested_prefix_) {
       sub_.request(prefix_size_);

diff --git a/libcaf_core/caf/flow/op/ucast.hpp b/libcaf_core/caf/flow/op/ucast.hpp
@@ -123,6 +123,9 @@ class ucast_sub_state : public detail::plain_ref_counted {
       auto got_some = demand > 0 && !buf.empty();
       for (bool run = got_some; run; run = demand > 0 && !buf.empty()) {
         out.on_next(buf.front());
+        // Note: on_next may call dispose().
+        if (disposed)
+          return;
         buf.pop_front();
         --demand;
       }
@@ -166,6 +169,8 @@ class ucast_sub : public subscription::impl_base {
   }
 
   void request(size_t n) override {
+    if (!state_)
+      return;
     state_->demand += n;
     if (state_->when_demand_changed)
       state_->when_demand_changed.run();