From d6b7cde71823993b0e4a424333fadde99666a7e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Rydg=C3=A5rd?= Date: Sun, 3 Dec 2017 02:33:21 +0100 Subject: [PATCH] Fix a use-after-free in sceKernelTerminateDeleteThread --- Core/HLE/sceKernelThread.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Core/HLE/sceKernelThread.cpp b/Core/HLE/sceKernelThread.cpp index c9588334cb..0e15bfe1e6 100644 --- a/Core/HLE/sceKernelThread.cpp +++ b/Core/HLE/sceKernelThread.cpp @@ -2276,6 +2276,8 @@ int sceKernelTerminateDeleteThread(int threadID) if (t) { bool wasStopped = t->isStopped(); + uint32_t attr = t->nt.attr; + uint32_t uid = t->GetUID(); INFO_LOG(SCEKERNEL, "sceKernelTerminateDeleteThread(%i)", threadID); error = __KernelDeleteThread(threadID, SCE_KERNEL_ERROR_THREAD_TERMINATED, "thread terminated with delete"); @@ -2283,7 +2285,7 @@ int sceKernelTerminateDeleteThread(int threadID) if (!wasStopped) { // Set v0 before calling the handler, or it'll get lost. RETURN(error); - __KernelThreadTriggerEvent((t->nt.attr & PSP_THREAD_ATTR_KERNEL) != 0, t->GetUID(), THREADEVENT_EXIT); + __KernelThreadTriggerEvent((attr & PSP_THREAD_ATTR_KERNEL) != 0, uid, THREADEVENT_EXIT); } return error;