Fix use after free crash

extension/extension.cpp

@@ -27,7 +27,6 @@
 
 #include <IWebternet.h>
 #include "MemoryDownloader.h"
-#include "forwards.h"
 #include "natives.h"
 
 #if defined _LINUX
@@ -1085,25 +1084,6 @@ class UploadThread: public IThread
 	}
 } uploadThread;
 
-class SourcePawnNotifyThread : public IThread
-{
-public:
-
-	void RunThread(IThreadHandle* pHandle) {
-		for (;;) {
-			// Wait until OnMapStart is called once, this should be enough delay to make sure plugins are loaded.
-			if (g_accelerator.IsMapStarted() && g_accelerator.IsDoneUploading()) {
-				extforwards::CallOnDoneUploadingForward();
-				break;
-			}
-		}
-	}
-
-	void OnTerminate(IThreadHandle* pHandle, bool cancel) {
-	}
-
-} spNotifyThread;
-
 class VFuncEmptyClass {};
 
 const char *GetCmdLine()
@@ -1142,7 +1122,7 @@ const char *GetCmdLine()
 }
 
 Accelerator::Accelerator() :
-	m_doneuploading(false), m_maphasstarted(false)
+	m_doneuploading(false), m_maphasstarted(false), m_outter(this)
 {
 }
 
@@ -1171,8 +1151,8 @@ bool Accelerator::SDK_OnLoad(char *error, size_t maxlength, bool late)
 	strncpy(crashGameDirectory, g_pSM->GetGameFolderName(), sizeof(crashGameDirectory) - 1);
 
 	threader->MakeThread(&uploadThread);
-	threader->MakeThread(&spNotifyThread); // This thread waits for accelator to be done uploading and for the first OnMapStart call, then fires a SourceMod forward
-
+	threader->MakeThread(&m_spNotifyThread); // This thread waits for accelator to be done uploading and for the first OnMapStart call, then fires a SourceMod forward
+	
 	do {
 		char gameconfigError[256];
 		if (!gameconfs->LoadGameConfigFile("accelerator.games", &gameconfig, gameconfigError, sizeof(gameconfigError))) {
@@ -1353,6 +1333,7 @@ void Accelerator::SDK_OnUnload()
 {
 	extforwards::Shutdown();
 	plsys->RemovePluginsListener(this);
+	m_spNotifyThread.Shutdown();
 
 #if defined _LINUX
 	g_pSM->RemoveGameFrameHook(OnGameFrame);

extension/extension.h

@@ -30,6 +30,7 @@
 #include <vector>
 #include <mutex>
 #include "smsdk_ext.h"
+#include "forwards.h"
 
 /**
  * @brief Represents a crash that has been successfully uploaded to Accelerator's backend
@@ -133,6 +134,35 @@ class Accelerator : public SDKExtension, IPluginsListener
 	mutable std::mutex m_uploadedcrashes_mutex; // mutex for accessing the m_uploadedcrashes vector
 	std::atomic_bool m_doneuploading; // Signals that Accelerator is done uploading crashes.
 	std::atomic_bool m_maphasstarted; // Signals that OnMapStart has been called at least once.
+
+	class SourcePawnNotifyThread : public IThread
+	{
+	public:
+		SourcePawnNotifyThread(Accelerator* outter) : m_outter(outter), m_terminated(false), m_shutdown(false) {}
+		~SourcePawnNotifyThread() { while (!m_terminated) {} }
+
+		void RunThread(IThreadHandle* pHandle) {
+			while (!m_shutdown) {
+				// Wait until OnMapStart is called once, this should be enough delay to make sure plugins are loaded.
+				if (m_outter->IsMapStarted() && m_outter->IsDoneUploading()) {
+					extforwards::CallOnDoneUploadingForward();
+					break;
+				}
+			}
+		}
+
+		void OnTerminate(IThreadHandle* pHandle, bool cancel) {
+			m_terminated = true;
+		}
+
+		void Shutdown() {
+			m_shutdown = true;
+		}
+
+		Accelerator* m_outter;
+		bool m_terminated;
+		bool m_shutdown;
+	} m_spNotifyThread;
 };
 
 // Expose the extension singleton.