| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix: prevent heap corruption when a request is torn down A request is destroyed synchronously inside RequestManager::Remove's deque erase, so a subscription cleanup that ran complex logic inline corrupted the heap (jemalloc "may double free"). Reset every request's subscriptions in Destroy() (which always runs before the destructor, since Remove is posted from Destroy) and defer the complex parts of subscription cleanups to the next resident event-loop turn. 🤖 AI[18%] 🔧 Human Fixed[0%] 🧑 Human[82%] 👌 AI Adopted[100%] Change-Id: I66a965b03f67f13513dcc066f920cad90012309e Signed-off-by: Tianshi Liu <tianshi.liu@huawei.com> | 21 天前 | |
fix: harden callback flows and IPC input validation per security audit - ensure device select results are always delivered on framework failure paths - deduplicate device select result handling in host requests - validate pending reply match in message router and bound business id arrays - add XCollie watchdogs for settings, os account and misc manager calls - use RAII subscriptions for callback death recipients with per-subscription limits - cancel timed-out resident sync tasks before execution - add tests for repeated select result delivery and pending token entry discard Signed-off-by: Tianshi Liu <tianshi.liu@huawei.com> 🤖 AI[10%] 🔧 Human Fixed[0%] 🧑 Human[90%] 👌 AI Adopted[100%] Change-Id: Ib1b1db5d411f2cbcca669a3c3ad64a0e1e1aea2d | 4 天前 |