Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-23 21:29:49 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix #11399 Use-after-free and a memory leak in handling of WASM binaries (#11533)

Browse Source 
* Fix issue #11399: use-after-free in symbols()

Commit 7e083b57f introduced the issue #11399. The list referenced by
`codes` in entries(), is the same list that bf->g_codes is pointing at.
By freeing it, we introduce a use-after-free condition in a later call
to symbols(), where we try to iterate over the list that bf->g_codes
was supposed to be referencing.

* Fix memleak during loading of WASM binaries

A memory leak is reported by ASAN when handling WASM binaries. It is
caused by multiple allocations of RBinInfo structure. First, RBinInfo
is allocated within a call to size() from r_bin_object_set_items(). Then
there is another, explicit allocation of an RBinInfo structure through
a call to the info() callback of the WASM RBinPlugin. This causes loss
of reference to the initial structure, and subsequently a leak.

There are no apparent uses of RBinInfo structure inbetween these two
points, and the size() result is in no way dependent on this structure,
therefore I resolved the memory leak issue by removing the allocation
from within the size() function.
This commit is contained in:
Dimitris Karagkasidis 2018-09-15 22:51:38 +02:00 committed by radare
parent e6eaa95c1d
commit e238026086
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libr/bin/p/bin_wasm.c
View File

@ -72,7 +72,6 @@ static RList *entries(RBinFile *bf) {
}
if (!addr) {
r_list_free (ret);
r_list_free (codes);
return NULL;
}
}
@ -270,10 +269,7 @@ static RBinInfo *info(RBinFile *bf) {
}
static ut64 size(RBinFile *bf) {
if (!bf->o->info) {
bf->o->info = info (bf);
}
if (!bf->o->info) {
if (!bf || !bf->buf) {
return 0;
}
return bf->buf->length;