mirror of
https://github.com/aria2/aria2.git
synced 2026-04-13 00:09:32 +00:00
570bc24fb9
DefaultPieceStorage may be referenced by one of DHT task (e.g., DHTPeerLookupTask), after RequestGroup was deleted, and even after RequestGroupMan was deleted. DefaultPieceStorage has a reference to MultiDiskAdaptor which calls RequestGroupMan object on destruction. So when DHT task is destroyed, DefaultPieceStorage is destroyed, which in turn destroys MultiDiskAdaptor. DHT task is destroyed after RequestGroupMan was destroyed, MultiDiskAdaptor will use now freed RequestGroupMan object, this is use-after-free.
See README.rst