From ddbd0bcda455607032b5add70e6793908b31b85b Mon Sep 17 00:00:00 2001
From: huangyuchen <huangyuchen3@huawei.com>
Date: Mon, 3 Jul 2023 07:30:02 +0000
Subject: [PATCH] Revert "Fix UAF issue on timer."

Issue:I7HXQO
Test:UT

Signed-off-by: huangyuchen <huangyuchen3@huawei.com>
Change-Id: I47b1c49a2186d66dd7fcdc9dd5780b2f621ea2f3
---
 base/src/event_demultiplexer.cpp | 20 ++++----------------
 base/src/event_demultiplexer.h   |  3 +--
 base/src/event_handler.h         |  4 +---
 base/src/timer.cpp               |  8 ++++++++
 base/src/timer_event_handler.h   |  2 +-
 5 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/base/src/event_demultiplexer.cpp b/base/src/event_demultiplexer.cpp
index e444684..87df8a7 100644
--- a/base/src/event_demultiplexer.cpp
+++ b/base/src/event_demultiplexer.cpp
@@ -70,7 +70,7 @@ uint32_t EventDemultiplexer::UpdateEventHandler(EventHandler* handler)
     std::lock_guard<std::recursive_mutex> lock(mutex_);
     auto itor = eventHandlers_.find(handler->GetHandle());
     if (itor == eventHandlers_.end()) {
-        eventHandlers_.insert(std::make_pair(handler->GetHandle(), handler->shared_from_this()));
+        eventHandlers_.insert(std::make_pair(handler->GetHandle(), handler));
         return Update(EPOLL_CTL_ADD, handler);
     }
 
@@ -79,7 +79,7 @@ uint32_t EventDemultiplexer::UpdateEventHandler(EventHandler* handler)
         return Update(EPOLL_CTL_DEL, handler);
     }
 
-    if (handler != itor->second.get()) {
+    if (handler != itor->second) {
         return TIMER_ERR_DEAL_FAILED;
     }
     return Update(EPOLL_CTL_MOD, handler);
@@ -102,19 +102,7 @@ uint32_t EventDemultiplexer::Update(int operation, EventHandler* handler)
 
 void EventDemultiplexer::Polling(int timeout /* ms */)
 {
-    std::vector<std::shared_ptr<EventHandler>> holdHandlers;
     std::vector<struct epoll_event> epollEvents(maxEvents_);
-    {
-        std::lock_guard<std::recursive_mutex> lock(mutex_);
-        if (eventHandlers_.size() == 0) {
-            return;
-        }
-
-        for (auto itor = eventHandlers_.begin(); itor != eventHandlers_.end();++itor) {
-            holdHandlers.emplace_back(itor->second);
-        }
-    }
-
     int nfds = epoll_wait(epollFd_, &epollEvents[0], static_cast<int>(epollEvents.size()), timeout);
     if (nfds == 0) {
         return;
@@ -125,8 +113,8 @@ void EventDemultiplexer::Polling(int timeout /* ms */)
     }
 
     for (int idx = 0; idx < nfds; ++idx) {
-        void* ptr = epollEvents[idx].data.ptr;
         uint32_t events = epollEvents[idx].events;
+        void* ptr = epollEvents[idx].data.ptr;
         auto handler = reinterpret_cast<EventHandler*>(ptr);
         if (handler != nullptr) {
             handler->HandleEvents(Epoll2Reactor(events));
@@ -161,4 +149,4 @@ uint32_t EventDemultiplexer::Reactor2Epoll(uint32_t reactorEvent)
 }
 
 }
-}
\ No newline at end of file
+}
diff --git a/base/src/event_demultiplexer.h b/base/src/event_demultiplexer.h
index 13fe966..5c25e56 100644
--- a/base/src/event_demultiplexer.h
+++ b/base/src/event_demultiplexer.h
@@ -17,7 +17,6 @@
 #define UTILS_EVENT_DEMULTIPLEXER_H
 
 #include <mutex>
-#include <memory>
 #include <cstdint>
 #include <map>
 
@@ -48,7 +47,7 @@ private:
     int epollFd_;
     int maxEvents_;
     std::recursive_mutex mutex_;
-    std::map<int, std::shared_ptr<EventHandler>> eventHandlers_; // guard by mutex_
+    std::map<int, EventHandler*> eventHandlers_; // guard by mutex_
 };
 
 }
diff --git a/base/src/event_handler.h b/base/src/event_handler.h
index 511bb6f..af75cbe 100644
--- a/base/src/event_handler.h
+++ b/base/src/event_handler.h
@@ -19,15 +19,13 @@
 #include <cstdint>
 #include <map>
 #include <functional>
-#include <unistd.h>
-#include <memory>
 
 namespace OHOS {
 namespace Utils {
 
 class EventReactor;
 
-class EventHandler : public std::enable_shared_from_this<EventHandler> {
+class EventHandler {
 public:
     using Callback = std::function<void()>;
 
diff --git a/base/src/timer.cpp b/base/src/timer.cpp
index bb4db90..4fc9a1d 100644
--- a/base/src/timer.cpp
+++ b/base/src/timer.cpp
@@ -49,6 +49,14 @@ void Timer::Shutdown(bool useJoin)
     }
 
     reactor_->SwitchOff();
+    if (timeoutMs_ == -1) {
+        std::lock_guard<std::mutex> lock(mutex_);
+        if (intervalToTimers_.empty()) {
+            UTILS_LOGI("no event for epoll wait, use detach to shutdown");
+            thread_.detach();
+            return;
+        }
+    }
     if (!useJoin) {
         thread_.detach();
         return;
diff --git a/base/src/timer_event_handler.h b/base/src/timer_event_handler.h
index 1fd0bd6..3201480 100644
--- a/base/src/timer_event_handler.h
+++ b/base/src/timer_event_handler.h
@@ -55,7 +55,7 @@ private:
     uint32_t       interval_;
     EventReactor*  reactor_;
 
-    std::shared_ptr<EventHandler> handler_;
+    std::unique_ptr<EventHandler> handler_;
     TimerCallback                 callback_;
 };
 
-- 
Gitee