From 17de611a22c21d62cec96db61007d199a1b1927f Mon Sep 17 00:00:00 2001
From: FooIbar <118464521+FooIbar@users.noreply.github.com>
Date: Tue, 15 Jul 2025 00:00:13 +0800
Subject: [PATCH] Actually fix the UAF

The archive may be closed before the decoding job finishes.

This reverts commit 4b25fb8363facfc5868ffcf35b12c855aa44924f.
---
 .../com/hippo/ehviewer/coil/AnimatedWebPDrawable.kt       | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/src/main/kotlin/com/hippo/ehviewer/coil/AnimatedWebPDrawable.kt b/app/src/main/kotlin/com/hippo/ehviewer/coil/AnimatedWebPDrawable.kt
index e16056eee..617836a01 100644
--- a/app/src/main/kotlin/com/hippo/ehviewer/coil/AnimatedWebPDrawable.kt
+++ b/app/src/main/kotlin/com/hippo/ehviewer/coil/AnimatedWebPDrawable.kt
@@ -15,8 +15,11 @@ import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
+import kotlinx.coroutines.cancelAndJoin
 import kotlinx.coroutines.ensureActive
+import kotlinx.coroutines.job
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
 
 // Hold a reference to the buffer as it's used by the decoder
 @Suppress("CanBeParameter")
@@ -133,9 +136,10 @@ class AnimatedWebPDrawable(private val source: ByteBuffer) : Drawable(), Animata
     }
 
     fun dispose() {
-        decodeScope.launch {
-            nativeDestroyDecoder(decoder)
+        runBlocking {
+            decodeScope.coroutineContext.job.cancelAndJoin()
         }
+        nativeDestroyDecoder(decoder)
     }
 }