Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-27 15:10:53 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix uaf and another memleak

Browse Source
This commit is contained in:
pancake 2016-04-04 00:36:18 +02:00
parent e8263655be
commit 54fe1ae941
4 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libr/anal/op.c
View File

@ -46,13 +46,19 @@ R_API void r_anal_op_fini(RAnalOp *op) {
r_anal_value_free (op->src[2]);
r_anal_value_free (op->dst);
r_anal_switch_op_free (op->switch_op);
free (op->mnemonic);
memset (op, 0, sizeof (RAnalOp));
op->src[0] = NULL;
op->src[1] = NULL;
op->src[2] = NULL;
op->dst = NULL;
op->var = NULL;
op->switch_op = NULL;
R_FREE (op->mnemonic);
}
R_API void r_anal_op_free(void *_op) {
if (!_op) return;
r_anal_op_fini (_op);
memset (_op, 0, sizeof (RAnalOp));
free (_op);
}

2
libr/bin/bin.c
View File

@ -733,7 +733,7 @@ R_API int r_bin_load_io_at_offset_as_sz(RBin *bin, RIODesc *desc, ut64 baseaddr,
binfile = r_bin_file_new_from_bytes (bin, desc->name, buf_bytes, sz,
file_sz, bin->rawstr, baseaddr, loadaddr, desc->fd, name, NULL, offset);
}
free (buf_bytes); //heap use after free
// free (buf_bytes); //heap use after free
return binfile? r_bin_file_set_cur_binfile (bin, binfile): false;
}

1
libr/core/core.c
View File

@ -258,6 +258,7 @@ static ut64 num_callback(RNum *userptr, const char *str, int *ok) {
// TODO: group analop-dependant vars after a char, so i can filter
r_anal_op (core->anal, &op, core->offset,
core->block, core->blocksize);
r_anal_op_fini (&op); // we dont need strings or pointers, just values, which are not nullified in fini
switch (str[1]) {
case '.': // can use pc, sp, a0, a1, ...
return r_debug_reg_get (core->dbg, str+2);

10
sys/xx.sh Executable file
View File

@ -0,0 +1,10 @@
#!/bin/sh
ID="$1"
if [ -z "$ID" ]; then
echo "Usage: sys/xx.sh [travis-job-id]"
exit 1
fi
curl -L "https://api.travis-ci.org/jobs/${ID}/log.txt?deansi=true"