Repository navigation
Conversation
…UAF (PR DaveGamble#1109) Merging a patch that is a subtree of its target freed the patch along with the target and then read it back (heap-use-after-free). PR DaveGamble#1109 fixes the non-object-target path; this test pins the exact variant (object patch that is an element of an array target). Red/green verified locally: segfaults on master at 6d9f244 (plain and ASan+UBSan builds), passes with DaveGamble#1109 applied (7/7 green). Intended to land after DaveGamble#1109; until then it fails as expected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion regression test for #1109, as offered on the PR and accepted by @Oculytic.
What it covers: merging an object patch that is a subtree of its target (here an element of an array target
[1, 2, {"a": 1}]). Without the #1109 fix,merge_patchdeletes the target (freeing the patch with it) and then reads the freed patch back — heap-use-after-free.Red/green evidence (fresh clone at 6d9f244,
tests/old_utils_tests.conly file changed):cJSON_IsNullvia the dangling patch pointer).merge_patch_object_patch_subtree_of_array_target.Note: this test fails until #1109 merges — please land #1109 first (or together). Written in the file's existing Unity style; no production code touched.
AI disclosure: drafted with AI assistance (Muse), validated by local red/green runs; independent review welcome.