Files
strongswan-ext/src/libstrongswan/threading
Tobias Brunner f00b85dbf4 windows: Fix potential use-after-free when joining a thread
Because the flag was set before running the TLS cleanup, a thread
waiting in `join()` could exit the loop and destroy the thread object
before `docleanup()` is called in `end_thread()`.

This change removes the `terminated` flag and instead properly waits for
the thread to exit in `join()`.  By always removing the threads from the
hashtable in `end_thread()`, we also avoid requiring to check any flags
in `cleanup_tls()`, as it now only finds an object for external threads.

We now also make sure to call `docleanup()` before removing the thread
from the hashtable.  Otherwise, if a TLS cleanup callback calls
`thread_current[_id]()`, a new thread object would get created that is
never cleaned up.

Fixes: 0fa9c95811 ("windows: Provide a complete native Windows threading backend")
2026-07-24 08:47:39 +02:00
..