fix use-after-free with duplicate names in the archive file system (PR #26927)
Javid Khan
the archive file system caches each entry in a hash keyed by name that owns the entry, alongside a parallel list holding raw pointers to those same entries. zip and tar both allow several members with the same name, and caching a duplicate overwrites the hash slot and frees the earlier entry while its list node still points at it, so re-enumerating the cached archive reads freed memory (an ASAN use-after-free in DoFind, reachable through wxFileSystem for a crafted archive). the fix moves ownership of the entries onto the list nodes and leaves the hash as a non-owning index, so a duplicate name only re-points the lookup and never frees an entry that is still referenced. added a regression test that enumerates a zip containing two identically named entries.
You can view, comment on, or merge this pull request online at:
https://github.com/wxWidgets/wxWidgets/pull/26927
Commit Summary
- 18d4028 fix use-after-free with duplicate names in the archive file system
File Changes
(2 files)
- M src/common/fs_arc.cpp (19)
- M tests/filesys/filesystest.cpp (85)
Patch Links:
- https://github.com/wxWidgets/wxWidgets/pull/26927.patch
- https://github.com/wxWidgets/wxWidgets/pull/26927.diff
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.
VZ
vadz left a comment (wxWidgets/wxWidgets#26927)Thanks for fixing this! Will merge soon.
In principle, this could be backported to 3.2 too but it would require some changes to compile with C++98, please submit a separate PR for it if you'd like to have it there.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.
VZ
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.
Javid Khan
dxbjavid left a comment (wxWidgets/wxWidgets#26927)thanks for merging this. i'll leave the 3.2 backport for now, but might send a separate PR for it later.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.