Fix stale removal comments (persistent, not destroy) + add deterministic install test
- The remove_* comments still described the superseded "disable -> drain -> destroy" flow; the code keeps hooks alive (persistent) and re-enables on re-install. Updated the comments to match, and corrected the XInput note (its detours return synthesized state and never call the trampoline, so destroying its vector is safe -- unlike the trampoline-calling present/MKB/focus-cursor hooks). - hook_install_test: a fast, single-threaded contract test for hook_install.hpp -- install_inline creates the hook once and reuses the SAME trampoline across 50 install/remove cycles (never freed -> no stale-detour UAF), toggling enable/disable cleanly. Fills the guard the removed (flaky, concurrency-bound) reproducer left, with no threads so it can't flake on SafetyHook's enable/disable atomicity. x64 23/23, x86 3/3. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -323,11 +323,11 @@ bool install_opengl_hooks(IpcClient& ipc)
|
||||
|
||||
void remove_opengl_hooks()
|
||||
{
|
||||
// DISABLE (not destroy) first: restores the SwapBuffers bytes under thread suspension (no new
|
||||
// detour) but keeps the trampolines alive, so an in-flight detour about to call .stdcall() (the
|
||||
// trampoline) doesn't have it freed under it. Destroying (= {}) before the drain frees the
|
||||
// trampoline immediately -- a UAF the uncapped mock-game storm (thousands of swaps/s) can hit.
|
||||
// Disable -> drain -> only then destroy.
|
||||
// DISABLE (persistent model -- never destroy during the session): restores the SwapBuffers bytes
|
||||
// under thread suspension (no new detour) but keeps the trampolines alive, so an in-flight detour
|
||||
// about to call .stdcall() (the trampoline) never has it freed under it. Destroying (= {}) would
|
||||
// free it -- a UAF the thousands/s storm can hit. Disable -> drain -> leave alive (re-install
|
||||
// re-enables; see hook_install.hpp).
|
||||
disable_for_removal(g_hk_swapbuffers);
|
||||
disable_for_removal(g_hk_wglswap);
|
||||
hook_set_installed(g_id_swapbuffers, false);
|
||||
|
||||
Reference in New Issue
Block a user