Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2025-02-02 19:55:14 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Initial band-aid fix for a UAF with two seperate desc pointers (#14094)

Browse Source
This commit is contained in:
Alex Gaines 2019-05-17 15:19:26 -04:00 committed by radare
parent 0b880ed0b0
commit 8ba3d1077b
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libr/debug/p/debug_gdb.c
View File

@ -13,6 +13,7 @@ typedef struct {
#define UNSUPPORTED 0
#define SUPPORTED 1
static RIOGdb ** origriogdb = NULL;
static libgdbr_t *desc = NULL;
static ut8* reg_buf = NULL;
static int buf_size = 0;
@ -363,6 +364,7 @@ static int r_debug_gdb_attach(RDebug *dbg, int pid) {
if (d && d->plugin && d->plugin->name && d->data) {
if (!strcmp ("gdb", d->plugin->name)) {
RIOGdb *g = d->data;
origriogdb = (RIOGdb **)&d->data; //TODO bit of a hack, please improve
support_sw_bp = UNKNOWN;
support_hw_bp = UNKNOWN;
int arch = r_sys_arch_id (dbg->arch);
@ -1044,7 +1046,8 @@ static bool r_debug_gdb_kill(RDebug *dbg, int pid, int tid, int sig) {
}
static int r_debug_gdb_select(int pid, int tid) {
if (!desc) {
if (!desc || !*origriogdb ) {
desc = NULL; //TODO hacky fix, please improve. I would suggest using a **desc instead of a *desc, so it is automatically updated
return false;
}
return gdbr_select (desc, pid, tid) >= 0;

3
libr/io/p/io_gdb.c
View File

@ -179,6 +179,9 @@ static int __close(RIODesc *fd) {
}
gdbr_disconnect (desc);
gdbr_cleanup (desc);
if (riogdb) { //TODO is there a less band-aid fix to do this?
riogdb->data = NULL;
}
R_FREE (desc);
return -1;
}