openslide/openslide — Issue #89: Cache can free a value that is still in use
Author: bgilbert
Created: 2012-02-18 04:14:21+00:00
State: open
Labels: defect

When `_openslide_cache_get()` hits, it moves the returned value to the head of the MRU list but makes no other effort to keep it alive until the caller is done with it. Perverse thread scheduling, or lots of reader threads, could thus cause a use-after-free. Existing serialization happens to prevent this for the TIFF and JPEG backends, but no such luck for NGR.