b
/
go-ph7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed use-after-free bug from AddImportPath

This commit is contained in:
Brandon Dyck 2022-11-28 23:59:12 -07:00
parent 01fc848621
commit 5bc4967b63
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
ph7.go
View File

@ -124,6 +124,7 @@ func (e *Engine) compileError(code C.int) error {
func (e *Engine) Compile(source []byte, phpOnly bool) (*VM, error) {
csource := C.CBytes(source)
// TODO Is this a UAF bug?
defer C.free(csource)
var flags C.int
if phpOnly {
@ -140,6 +141,7 @@ func (e *Engine) Compile(source []byte, phpOnly bool) (*VM, error) {
func (e *Engine) CompileFile(path string, phpOnly bool) (*VM, error) {
cpath := C.CString(path)
// TODO Is this a UAF bug?
defer C.free(unsafe.Pointer(cpath))
var flags C.int
@ -468,6 +470,7 @@ type VM struct {
outputWriter io.Writer
outputWriteErr error
userFunctionKeys []unsafe.Pointer
retainedPointers []unsafe.Pointer
}
func newVM(cvm *C.ph7_vm) *VM {
@ -477,6 +480,10 @@ func newVM(cvm *C.ph7_vm) *VM {
return vm
}
func (vm *VM) retainPointer(p unsafe.Pointer) {
vm.retainedPointers = append(vm.retainedPointers, p)
}
//export write_vm_output
func write_vm_output(buf unsafe.Pointer, bufLen C.uint, userData unsafe.Pointer) C.int {
vm := pointer.Restore(userData).(*VM)
@ -496,7 +503,7 @@ func (vm *VM) SetOutputWriter(w io.Writer) error {
func (vm *VM) AddImportPath(path string) error {
cpath := C.CString(path)
defer C.free(unsafe.Pointer(cpath))
vm.retainPointer(unsafe.Pointer(cpath))
return newError(C.vm_add_import_path(vm.ptr, cpath))
}
@ -560,6 +567,9 @@ func (vm *VM) Close() error {
for _, key := range vm.userFunctionKeys {
pointer.Unref(key)
}
for _, p := range vm.retainedPointers {
C.free(p)
}
return newError(C.ph7_vm_release(vm.ptr))
}
@ -580,6 +590,7 @@ func call_foreign_function(ctx *C.ph7_context, argc C.int, argv **C.ph7_value) C
func (vm *VM) CreateFunction(name string, f Function) error {
cname := C.CString(name)
// TODO Is this a UAF bug?
defer C.free(unsafe.Pointer(cname))
fkey := pointer.Save(f)