Skip to content

Logger::shutdown() use-after-free #5324

@aleks-f

Description

@aleks-f

Problem

Logger::shutdown() destroys all Logger objects by resetting the logger map (_pLoggerMap.reset()). However, singletons and long-lived components commonly hold Logger& references obtained via Logger::get() during construction. When these singletons are destroyed during static destruction (after shutdown() has already run), they call methods on dangling Logger references, causing heap-use-after-free.

Any class that stores Logger& _logger = Logger::get(...) as a member is affected.

Root cause

Logger::shutdown() is called during LoggingSubsystem::uninitialize(), which runs before static singleton destructors. The loggers are freed, but references to them persist in singletons that are destroyed later via atexit handlers.

Fix

Change Logger::shutdown() to detach channels from all loggers instead of destroying the Logger objects. The loggers become silent (no channel) but remain valid. Since logImpl() already checks if (_pChannel) before logging, this makes all post-shutdown logging a safe no-op.

Affected code

  • Foundation/src/Logger.cpp -- Logger::shutdown() implementation

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions