Skip to content

Commit 53a8d79

Browse files
committed
Fix use-after-free of enum type id in set_int_display_type
`set_int_display_type` converted the optional enumeration type id to an owned C string, then moved it into a closure to take its pointer. The C string was dropped at the end of that closure, before `BNSetIntegerConstantDisplayType` ran, so the FFI call read freed memory and stored a garbage type id for the enumeration display. As a result an integer operand set to EnumerationDisplayType never resolved to its enumeration and rendered as a raw constant. Borrow the owned C string instead so it outlives the call.
1 parent d01e768 commit 53a8d79

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

rust/src/function.rs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1945,7 +1945,11 @@ impl Function {
19451945
) {
19461946
let arch = arch.unwrap_or_else(|| self.arch());
19471947
let enum_display_typeid = enum_display_typeid.map(IntoCStr::to_cstr);
1948+
// Borrow the owned C string rather than moving it into `map`, otherwise it is dropped
1949+
// before the FFI call below and `BNSetIntegerConstantDisplayType` reads freed memory,
1950+
// storing a garbage type id for the enumeration.
19481951
let enum_display_typeid_ptr = enum_display_typeid
1952+
.as_ref()
19491953
.map(|x| x.as_ptr())
19501954
.unwrap_or(std::ptr::null());
19511955
unsafe {

0 commit comments

Comments
 (0)