[ntcore] Fix a use-after-free in client close (#5844)

wpilibsuite · Oct 29, 2023 · 35472f5 · 35472f5
1 parent ed168b5
commit 35472f5
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/ntcore/src/main/native/cpp/NetworkClient.cpp b/ntcore/src/main/native/cpp/NetworkClient.cpp
@@ -418,9 +418,13 @@ void NetworkClient::WsConnected(wpi::WebSocket& ws, uv::Tcp& tcp,
   ws.closed.connect([this, &ws](uint16_t, std::string_view reason) {
     if (!ws.GetStream().IsLoopClosing()) {
       // we could be in the middle of sending data, so defer disconnect
+      // capture a shared_ptr copy of ws to make sure it doesn't get destroyed
+      // until after DoDisconnect returns
       uv::Timer::SingleShot(
           m_loop, uv::Timer::Time{0},
-          [this, reason = std::string{reason}] { DoDisconnect(reason); });
+          [this, reason = std::string{reason}, keepws = ws.shared_from_this()] {
+            DoDisconnect(reason);
+          });
     }
   });
   ws.text.connect([this](std::string_view data, bool) {