Thread-safety hazard in dwsUtils.TClassInstanceTemplate<T>.CreateInstance method

Hello,
I have discovered a thread-safety problem in the TClassInstanceTemplate<T>.CreateInstance method. The current implementation allows to return instance and keep the same in the FPool member. Scenario: Thread 1 calls CreateInstance, reads FPool contents and gets an instance, but before really invoking InterlockedCompareExchangePointer() thread 2 takes that instance. If thread 3 destroys another instance (putting in into FPool), then thread 1's call to InterlockedCompareExchangePointer will fail (comparing FPool to the old instance) but returning the new instance.
The proposed fix is to check returned value to the Result and bail otherwise, the patch is attached.

Best regards,
Joe

Comments (1)