Use after free bug
- Dominant language
- Rust
- Stars
- 62
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
When I called `debugger.create_target` with a platform name I got a error with a nonsensical code (way too big, looked like random memory) that returned an invalid string when asked for its message. I'm pretty sure the error is this code
```rust
// src/debugger.rs:232
let executable = CString::new(executable).unwrap();
let target_triple = target_triple.map(|s| CString::new(s).unwrap());
let platform_name = platform_name.map(|s| CString::new(s).unwrap());
let error = SBError::new();
let target = unsafe {
sys::SBDebuggerCreateTarget(
self.raw,
executable.as_ptr(),
target_triple.map_or(ptr::null(), |s| s.as_ptr()), // <-- HERE
platform_name.map_or(ptr::null(), |s| s.as_ptr()), // <-- HERE
add_dependent_modules as u8,
error.raw,
)
};
```
The problem is that `map_or` consumes the `Option`, so when it returns the option (may be) freed. lldb sees some random junk.
Replacing it with this fixes the issue, as the strings live until after the function call, and I no longer get an error.
```rust
let executable = CString::new(executable).unwrap();
let target_triple = target_triple.map(|s| CString::new(s).unwrap());
let platform_name = platform_name.map(|s| CString::new(s).unwrap());
let error = SBError::new();
let target = unsafe {
sys::SBDebuggerCreateTarget(
self.raw,
executable.as_ptr(),
target_triple.as_ref().map_or(ptr::null(), |s| s.as_ptr()),
platform_name.as_ref().map_or(ptr::null(), |s| s.as_ptr()),
add_dependent_modules as u8,
error.raw,
)
};
```
I'm relatively certain this isn't the only place with this sort of issue. I'm not up for fixing all of them, but I'll try and fix them when I see them and make a PR with more than just this one bug.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at src/debugger.rs:232 and inspect the lifetimes of the optional CString pointers passed to SBDebuggerCreateTarget. Reproduce the platform-name call and verify that the returned error code and message are valid; then search nearby bindings for similar map_or uses and check any affected calls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100