[Lldb-commits] [PATCH] D42346: Fix use after free in DiskFilesOrDirectories

[Raphael Isemann via Phabricator via lldb-commits]

teemperor created this revision.
teemperor added a reviewer: zturner.

We copy the local variable `Resolved` into `Storage` to keep it around. 
However, we then still let the `SearchDir` ref point to `Resolved` which then 
is used to access the already freed memory later on. With this patch we point 
to `Storage` which doesn't get deleted after the current scope exits.

Discovered by memory sanitizer in the CompletionTest.DirCompletionUsername test.


https://reviews.llvm.org/D42346

Files:
  source/Commands/CommandCompletions.cpp


Index: source/Commands/CommandCompletions.cpp
===================================================================
--- source/Commands/CommandCompletions.cpp
+++ source/Commands/CommandCompletions.cpp
@@ -165,7 +165,7 @@
     // search in the fully resolved directory, but CompletionBuffer keeps the
     // unmodified form that the user typed.
     Storage = Resolved;
-    SearchDir = Resolved;
+    SearchDir = Storage;
   } else {
     SearchDir = path::parent_path(CompletionBuffer);
   }



Index: source/Commands/CommandCompletions.cpp
===================================================================
--- source/Commands/CommandCompletions.cpp
+++ source/Commands/CommandCompletions.cpp
@@ -165,7 +165,7 @@
     // search in the fully resolved directory, but CompletionBuffer keeps the
     // unmodified form that the user typed.
     Storage = Resolved;
-    SearchDir = Resolved;
+    SearchDir = Storage;
   } else {
     SearchDir = path::parent_path(CompletionBuffer);
   }

_______________________________________________
lldb-commits mailing list
lldb-commits@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/lldb-commits