smokephil/ardour
1
0
Fork 0
mirror of https://github.com/Ardour/ardour.git synced 2026-01-30 00:43:18 +01:00
Code Issues Projects Releases Wiki Activity

Fix crash when removing sends/listen

Browse source 
When removing the monitor section, or any route that has sends
to it, Session::remove_routes will remove those sends. Despite
Route::remove_processor taking the process lock and removing
the send safely. The send itself will only be destroyed later.

Furthermore the send first calls ~BufferSet() on its
BufferSet mixbufs, before it itself is destroyed.

It was possible to still respond to CycleStart signal which
accessed the mixbufs from the RT thread, causing a heap-use-after-free.
This commit is contained in:
Robin Gareus 2026-01-27 00:12:42 +01:00
parent 20722ce852
commit 6c93112a7e
No known key found for this signature in database
GPG key ID: A090BCE02CF57F04
2 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
libs/ardour/ardour/internal_send.h
View file

@ -73,6 +73,7 @@ private:
bool _allow_feedback;
PBD::ID _send_to_id;
PBD::ScopedConnection connect_c;
PBD::ScopedConnection cycle_connection;
PBD::ScopedConnection source_connection;
PBD::ScopedConnectionList target_connections;

3
libs/ardour/internal_send.cc
View file

@ -69,11 +69,12 @@ InternalSend::InternalSend (Session& s,
init_gain ();
_send_from->DropReferences.connect_same_thread (source_connection, std::bind (&InternalSend::send_from_going_away, this));
CycleStart.connect_same_thread (*this, std::bind (&InternalSend::cycle_start, this, _1));
CycleStart.connect_same_thread (cycle_connection, std::bind (&InternalSend::cycle_start, this, _1));
}
InternalSend::~InternalSend ()
{
cycle_connection.disconnect ();
propagate_solo ();
if (_send_to) {
_send_to->remove_send_from_internal_return (this);