From 8e791e9041400d6588f7f87672c917e72e89b1c2 Mon Sep 17 00:00:00 2001 From: Anton Karpov Date: Mon, 3 Aug 2026 19:14:15 +0300 Subject: [PATCH 1/2] Set the caller's pointer to NULL in the destroy functions t8_stash_destroy and t8_cmesh_trees_destroy take a pointer to the caller's handle so they can clear it after freeing, and the header documents exactly that: "The pointer is set to NULL after the function call." Both assign to the parameter itself instead of dereferencing it, so the caller keeps a dangling pointer. This is not only theoretical. t8_cmesh_commit checks `cmesh->stash != nullptr` before destroying it, and again at t8_cmesh_commit.cxx:145 before reading `cmesh->stash->classes`, so the guard is written against a NULL that never arrives. t8_cmesh_bcast frees the stash and marks the cmesh committed while the cmesh stays alive. Signed-off-by: Anton Karpov --- src/t8_cmesh/t8_cmesh_internal/t8_cmesh_stash.c | 2 +- src/t8_cmesh/t8_cmesh_internal/t8_cmesh_trees.cxx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_stash.c b/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_stash.c index ca7571dd68..d251da7f5c 100644 --- a/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_stash.c +++ b/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_stash.c @@ -67,7 +67,7 @@ t8_stash_destroy (t8_stash_t *pstash) } sc_array_reset (&stash->attributes); T8_FREE (stash); - pstash = NULL; + *pstash = NULL; } void diff --git a/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_trees.cxx b/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_trees.cxx index 87f88d10b8..31bad3d5b8 100644 --- a/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_trees.cxx +++ b/src/t8_cmesh/t8_cmesh_internal/t8_cmesh_trees.cxx @@ -1292,5 +1292,5 @@ t8_cmesh_trees_destroy (t8_cmesh_trees_t *ptrees) sc_mempool_destroy (trees->global_local_mempool); T8_FREE (trees); - ptrees = nullptr; + *ptrees = nullptr; } From ae60415053b370350c9b7aa82e2247332a752e3e Mon Sep 17 00:00:00 2001 From: Anton Karpov Date: Mon, 3 Aug 2026 19:15:33 +0300 Subject: [PATCH 2/2] Add author file for Anton Karpov Signed-off-by: Anton Karpov --- doc/author_karpov.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 doc/author_karpov.txt diff --git a/doc/author_karpov.txt b/doc/author_karpov.txt new file mode 100644 index 0000000000..ba87602be2 --- /dev/null +++ b/doc/author_karpov.txt @@ -0,0 +1 @@ +I place my contributions to t8code under the FreeBSD license. Anton Karpov