authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-06-12 19:09:30-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-06-12 19:09:30-07:00
log2ad073ec6d4e2be967f18c9907844404a7eed42e
tree56c925bd7df84e5f223c31a7c8fa90606c8e2dc9
parent4b7c1e5c300c471618c9b12646247ef887a3a576

link/Plan9: fix UAF of symbol names

Long term, linker backends will need to manage their own string tables for things like this because my mandate is: no long-lived pointers allowed in any of the codepaths touched by incremental compilation, so that we can serialize and deserialize trivially. Short term, I solved this with a couple calls to Allocator.dupe, incurring some harmless leaks.

1 files changed, 2 insertions(+), 2 deletions(-)

src/link/Plan9.zig+2-2
...@@ -441,7 +441,7 @@ fn updateFinish(self: *Plan9, decl_index: Module.Decl.Index) !void {...@@ -441,7 +441,7 @@ fn updateFinish(self: *Plan9, decl_index: Module.Decl.Index) !void {
441 const sym: aout.Sym = .{441 const sym: aout.Sym = .{
442 .value = undefined, // the value of stuff gets filled in in flushModule442 .value = undefined, // the value of stuff gets filled in in flushModule
443 .type = decl_block.type,443 .type = decl_block.type,
444 .name = mod.intern_pool.stringToSlice(decl.name),444 .name = try self.base.allocator.dupe(u8, mod.intern_pool.stringToSlice(decl.name)),
445 };445 };
446446
447 if (decl_block.sym_index) |s| {447 if (decl_block.sym_index) |s| {
...@@ -741,7 +741,7 @@ fn addDeclExports(...@@ -741,7 +741,7 @@ fn addDeclExports(
741 const sym = .{741 const sym = .{
742 .value = decl_block.offset.?,742 .value = decl_block.offset.?,
743 .type = decl_block.type.toGlobal(),743 .type = decl_block.type.toGlobal(),
744 .name = exp_name,744 .name = try self.base.allocator.dupe(u8, exp_name),
745 };745 };
746746
747 if (metadata.getExport(self, exp_name)) |i| {747 if (metadata.getExport(self, exp_name)) |i| {