Skip to content

Class::retain has a TOCTOU bug #30

Description

@jdolan

Class::retain should use an atomic conditional swap, and hard-error if the condition is not met. The condition is: referenceCount > 0. If you are attempting to retain something with a reference count of 0, that Object is actively being freed in another thread, and you're fucked.

In researching this, I also learned that the _sync atomics are now considered "legacy" and that C11 introduced newer atomics at the language spec level, and they even have nicer names. We may want to just overhaul Class.c (and anywhere else in Objectively? tho Class.c might be the only place..) that uses _sync* to instead use the C11 atomics.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions