Skip to content

Conversation

@SiteRelEnby
Copy link
Contributor

@SiteRelEnby SiteRelEnby commented Dec 27, 2025

Commit e473c83 partially fixed UAF errors by introducing backlink_p to update the previous chunk's next pointer after realloc. However, when the first chunk is reallocated, backlink_p is NULL, so the root pointer (*chunks_p) never gets updated, leaving it pointing to freed memory.

This causes a use-after-free/double-free when read_ihex_file() later tries to free the chunk list.

Fix by updating *chunks_p directly when backlink_p is NULL (first chunk realloc case).

Valgrind confirmed this eliminates the UAF errors.

@gatk555
Copy link
Collaborator

gatk555 commented Dec 27, 2025

Thanks. It looks good, but the new variable seems unnecessary. Why not just "*chunks_p = chunk"? Also, please can you reduce the check-in comment to one line, and move the original to "Conversation". It is a good explanation, but the history does not need so much detail, and I would prefer to merge without modifying.

@gatk555 gatk555 closed this Dec 27, 2025
@gatk555 gatk555 reopened this Dec 27, 2025
@gatk555 gatk555 merged commit a6fc4cc into buserror:master Dec 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants