From 89a3076389586014cc1b773c543b09961851ceb9 Mon Sep 17 00:00:00 2001 From: JunsuChoi Date: Fri, 6 Feb 2026 14:03:44 +0900 Subject: [PATCH 1/3] Fix memory safety issues in waitForReply path Due to an issue with the app control lib, if false is returned from SendLaunchRequestWithReply, result_ptr may not be deleted, which may cause a memory leak. so replace manual memory management with std::make_shared to prevent potential memory leaks and crashes in async reply handling. --- .../tizen/channels/app_control_channel.cc | 22 ++++++++++++++----- 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/flutter/shell/platform/tizen/channels/app_control_channel.cc b/flutter/shell/platform/tizen/channels/app_control_channel.cc index 058b739c..42c679d7 100644 --- a/flutter/shell/platform/tizen/channels/app_control_channel.cc +++ b/flutter/shell/platform/tizen/channels/app_control_channel.cc @@ -5,6 +5,7 @@ #include "app_control_channel.h" #include +#include #include #include #include @@ -169,15 +170,24 @@ void AppControlChannel::SendLaunchRequest( std::unique_ptr> result) { EncodableValueHolder wait_for_reply(arguments, "waitForReply"); if (wait_for_reply && *wait_for_reply) { - auto* result_ptr = result.release(); - auto on_reply = [result_ptr](const EncodableValue& response) { - result_ptr->Success(response); - delete result_ptr; + auto result_box = + std::make_shared>>( + std::move(result)); + + auto on_reply = [result_box](const EncodableValue& response) { + if (!(*result_box)) { + return; + } + (*result_box)->Success(response); + result_box->reset(); }; + AppControlResult ret = app_control->SendLaunchRequestWithReply(on_reply); if (!ret) { - result_ptr->Error(ret.code(), ret.message()); - delete result_ptr; + if (*result_box) { + (*result_box)->Error(ret.code(), ret.message()); + result_box->reset(); + } } } else { AppControlResult ret = app_control->SendLaunchRequest(); From 361299308411e1e0d25c90479925f7caf983c7a0 Mon Sep 17 00:00:00 2001 From: JunsuChoi Date: Wed, 11 Feb 2026 13:25:24 +0900 Subject: [PATCH 2/3] enhance code --- .../platform/tizen/channels/app_control.cc | 1 + .../tizen/channels/app_control_channel.cc | 20 ++++++------------- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/flutter/shell/platform/tizen/channels/app_control.cc b/flutter/shell/platform/tizen/channels/app_control.cc index 1662fb09..edbf6494 100644 --- a/flutter/shell/platform/tizen/channels/app_control.cc +++ b/flutter/shell/platform/tizen/channels/app_control.cc @@ -67,6 +67,7 @@ AppControl::AppControl(app_control_h handle) : id_(next_id_++) { } AppControl::~AppControl() { + on_reply_ = nullptr; if (handle_) { app_control_destroy(handle_); } diff --git a/flutter/shell/platform/tizen/channels/app_control_channel.cc b/flutter/shell/platform/tizen/channels/app_control_channel.cc index 42c679d7..66dc9b70 100644 --- a/flutter/shell/platform/tizen/channels/app_control_channel.cc +++ b/flutter/shell/platform/tizen/channels/app_control_channel.cc @@ -170,24 +170,16 @@ void AppControlChannel::SendLaunchRequest( std::unique_ptr> result) { EncodableValueHolder wait_for_reply(arguments, "waitForReply"); if (wait_for_reply && *wait_for_reply) { - auto result_box = - std::make_shared>>( - std::move(result)); - - auto on_reply = [result_box](const EncodableValue& response) { - if (!(*result_box)) { - return; - } - (*result_box)->Success(response); - result_box->reset(); + std::shared_ptr> result_box{std::move(result)}; + auto on_reply = [&result_box](const EncodableValue& response) { + result_box->Success(response); + result_box = nullptr; }; AppControlResult ret = app_control->SendLaunchRequestWithReply(on_reply); if (!ret) { - if (*result_box) { - (*result_box)->Error(ret.code(), ret.message()); - result_box->reset(); - } + result_box->Error(ret.code(), ret.message()); + result_box = nullptr; } } else { AppControlResult ret = app_control->SendLaunchRequest(); From 303022e18032fa6d0aea37fabc102e1e40d7bfc0 Mon Sep 17 00:00:00 2001 From: JunsuChoi Date: Wed, 11 Feb 2026 14:21:25 +0900 Subject: [PATCH 3/3] ++ --- flutter/shell/platform/tizen/channels/app_control_channel.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/flutter/shell/platform/tizen/channels/app_control_channel.cc b/flutter/shell/platform/tizen/channels/app_control_channel.cc index 66dc9b70..bbedf883 100644 --- a/flutter/shell/platform/tizen/channels/app_control_channel.cc +++ b/flutter/shell/platform/tizen/channels/app_control_channel.cc @@ -171,15 +171,13 @@ void AppControlChannel::SendLaunchRequest( EncodableValueHolder wait_for_reply(arguments, "waitForReply"); if (wait_for_reply && *wait_for_reply) { std::shared_ptr> result_box{std::move(result)}; - auto on_reply = [&result_box](const EncodableValue& response) { + auto on_reply = [result_box](const EncodableValue& response) { result_box->Success(response); - result_box = nullptr; }; AppControlResult ret = app_control->SendLaunchRequestWithReply(on_reply); if (!ret) { result_box->Error(ret.code(), ret.message()); - result_box = nullptr; } } else { AppControlResult ret = app_control->SendLaunchRequest();