[Lldb-commits] [PATCH] D42346: Fix use after free in DiskFilesOrDirectories

[Raphael Isemann via Phabricator via lldb-commits]

teemperor created this revision.
teemperor added a reviewer: zturner.

We copy the local variable `Resolved` into `Storage` to keep it around. However, we then still let the `SearchDir` ref point to `Resolved` which then is used to access the already freed memory later on. With this patch we point to `Storage` which doesn't get deleted after the current scope exits.

Discovered by memory sanitizer in the CompletionTest.DirCompletionUsername test.


https://reviews.llvm.org/D42346

Files:
  source/Commands/CommandCompletions.cpp


Index: source/Commands/CommandCompletions.cpp
===================================================================
--- source/Commands/CommandCompletions.cpp
+++ source/Commands/CommandCompletions.cpp
@@ -165,7 +165,7 @@
     // search in the fully resolved directory, but CompletionBuffer keeps the
     // unmodified form that the user typed.
     Storage = Resolved;
-    SearchDir = Resolved;
+    SearchDir = Storage;
   } else {
     SearchDir = path::parent_path(CompletionBuffer);
   }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D42346.130796.patch
Type: text/x-patch
Size: 493 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/lldb-commits/attachments/20180121/0ea04cf9/attachment.bin>