Security context

Highlights

Use-After-Free: 13 prior fixes. Scrutinize any change in this area.

clay/lynx_adaptor/native_module/lynx_websocket_module.cc: most-fixed (2 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Use-After-Free: Multiple fixes address object lifetime issues during event dispatch and listener management. Raw pointers to Event and listener objects are used across asynchronous callbacks, leading to double-free and use-after-free when the dispatcher or listeners are destroyed during active dispatch. The fixes introduce reference counting and removal marking, but the pattern suggests other dispatch paths (e.g., Harmony-specific) may still use raw pointers.

Use-After-Free: Async callbacks (timers, Lepus method invocations, resource responses) capture raw pointers or references to objects that may be destroyed before the callback fires. The fixes use weak_ptr guards and shallow copies, but similar patterns exist in other async bridges (e.g., NAPI callbacks, JSC runtime) that may still hold dangling pointers.

Buffer Overflow: Two separate fixes replace stack-allocated alloca buffers and unsafe sscanf/snprintf calls with heap-backed std::vector and bounded string operations. This indicates a systemic issue with unsafe stack allocation and unbounded string parsing in the WebSocket native module, which could be exploited for stack overflow or memory corruption.