suyu/breakpad
26
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

module_unittest: fix use-after-free

Browse source 
`Construct.FunctionsWithSameAddress` started failing at ff5892c5. It
looks like the cause of this is in the calls to
`generate_duplicate_function`:

```
generate_duplicate_function("_without_form");
generate_duplicate_function("_and_void");
```

`generate_duplicate_function` directly calls `new
Module::Function(...);`, which stores the `StringView` it's given.
`generate_duplicate_function` currently takes a `const
string &`; in the above statements, these strings get `free()`d at the
`;`.

Making the parameter a `StringView` means the `Module::Function` will
store pointers to the string literal, which lives for the whole program.

All calls to `generate_duplicate_function` are given literals.

Bug: b:235999011
Change-Id: Ied04c1307a2467b9816a83f0c4d84d47779ec610
Reviewed-on: https://chromium-review.googlesource.com/c/breakpad/breakpad/+/3726855
Reviewed-by: Mike Frysinger <vapier@chromium.org>
This commit is contained in:
George Burgess IV 2022-06-27 13:11:00 -07:00 committed by Mike Frysinger
parent a8e8a69591
commit 0c816d2d12
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/common/module_unittest.cc
View file

@ -45,11 +45,12 @@
#include "common/using_std_string.h"
using google_breakpad::Module;
using google_breakpad::StringView;
using std::stringstream;
using std::vector;
using testing::ContainerEq;
static Module::Function* generate_duplicate_function(const string& name) {
static Module::Function* generate_duplicate_function(StringView name) {
const Module::Address DUP_ADDRESS = 0xd35402aac7a7ad5cULL;
const Module::Address DUP_SIZE = 0x200b26e605f99071ULL;
const Module::Address DUP_PARAMETER_SIZE = 0xf14ac4fed48c4a99ULL;