[vala/0.46] g-i: Calculate size correctly, avoid use-after-free



commit 7610129854e14788d7bba5cfe6fd9dfe304f01ea
Author: Rico Tzschichholz <ricotz ubuntu com>
Date:   Tue Nov 5 15:33:43 2019 +0100

    g-i: Calculate size correctly, avoid use-after-free

 gobject-introspection/gidlmodule.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)
---
diff --git a/gobject-introspection/gidlmodule.c b/gobject-introspection/gidlmodule.c
index d17a249a0..7eb1fe0ab 100644
--- a/gobject-introspection/gidlmodule.c
+++ b/gobject-introspection/gidlmodule.c
@@ -64,7 +64,7 @@ GMetadata *
 g_idl_module_build_metadata (GIdlModule  *module,
                             GList       *modules)
 {
-  guchar *metadata;
+  GMetadata *metadata;
   gsize length;
   gint i;
   GList *e;
@@ -102,6 +102,11 @@ g_idl_module_build_metadata (GIdlModule  *module,
       size += g_idl_node_get_full_size (node);
     }
 
+  /* Adjust size for strings allocated in header below specially */
+  size += strlen (module->name);
+  if (module->shared_library)
+    size += strlen (module->shared_library);
+
   g_message ("allocating %d bytes (%d header, %d directory, %d entries)\n", 
          size, header_size, dir_size, size - header_size - dir_size);
 
@@ -201,15 +206,19 @@ g_idl_module_build_metadata (GIdlModule  *module,
     }
 
   dump_stats ();
-  g_hash_table_destroy (strings);
-  g_hash_table_destroy (types);
 
   header->annotations = offset2;
   
   g_message ("reallocating to %d bytes", offset2);
 
-  metadata = g_realloc (data, offset2);
+  data = g_realloc (data, offset2);
+  header = (Header*) data;
   length = header->size = offset2;
-  return g_metadata_new_from_memory (metadata, length);
+  metadata = g_metadata_new_from_memory (data, length);
+
+  g_hash_table_destroy (strings);
+  g_hash_table_destroy (types);
+
+  return metadata;
 }
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]