Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-28 15:41:38 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix UAF io bank map deletion

Browse Source
This commit is contained in:
condret 2021-10-25 15:06:20 +02:00
parent 04998a7135
commit 5f25da4d37
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libr/io/io_bank.c
View File

@ -884,6 +884,7 @@ R_API void r_io_bank_del_map(RIO *io, const ut32 bankid, const ut32 mapid) {
break;
}
}
bank->last_used = NULL;
// map is not referenced by this bank; nothing to do
}

10
libr/util/new_rbtree.c
View File

@ -352,10 +352,12 @@ R_API bool r_crbtree_delete(RRBTree *tree, void *data, RRBComparator cmp, void *
free (q);
#else
_set_link (p, q->link[q->link[0] == NULL], p->link[1] == q);
q->link[0] = NULL;
q->link[1] = NULL;
q->parent = NULL;
_exchange_nodes (found, q);
if (q != found) {
q->link[0] = NULL;
q->link[1] = NULL;
q->parent = NULL;
_exchange_nodes (found, q);
}
if (tree->free) {
tree->free (found->data);
}