endoli / endoli/lldb.rs

Use after free bug

Open
#21 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
62
Forks
15
PR merge metrics
No merged PRs in 30d

Description

When I called `debugger.create_target` with a platform name I got a error with a nonsensical code (way too big, looked like random memory) that returned an invalid string when asked for its message. I'm pretty sure the error is this code

```rust
// src/debugger.rs:232
let executable = CString::new(executable).unwrap();
let target_triple = target_triple.map(|s| CString::new(s).unwrap());
let platform_name = platform_name.map(|s| CString::new(s).unwrap());
let error = SBError::new();
let target = unsafe {
sys::SBDebuggerCreateTarget(
self.raw,
executable.as_ptr(),
target_triple.map_or(ptr::null(), |s| s.as_ptr()), // <-- HERE
platform_name.map_or(ptr::null(), |s| s.as_ptr()), // <-- HERE
add_dependent_modules as u8,
error.raw,
)
};
```

The problem is that `map_or` consumes the `Option`, so when it returns the option (may be) freed. lldb sees some random junk.

Replacing it with this fixes the issue, as the strings live until after the function call, and I no longer get an error.

```rust
let executable = CString::new(executable).unwrap();
let target_triple = target_triple.map(|s| CString::new(s).unwrap());
let platform_name = platform_name.map(|s| CString::new(s).unwrap());
let error = SBError::new();
let target = unsafe {
sys::SBDebuggerCreateTarget(
self.raw,
executable.as_ptr(),
target_triple.as_ref().map_or(ptr::null(), |s| s.as_ptr()),
platform_name.as_ref().map_or(ptr::null(), |s| s.as_ptr()),
add_dependent_modules as u8,
error.raw,
)
};
```

I'm relatively certain this isn't the only place with this sort of issue. I'm not up for fixing all of them, but I'll try and fix them when I see them and make a PR with more than just this one bug.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at src/debugger.rs:232 and inspect the lifetimes of the optional CString pointers passed to SBDebuggerCreateTarget. Reproduce the platform-name call and verify that the returned error code and message are valid; then search nearby bindings for similar map_or uses and check any affected calls.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
devtools
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.