diff options
| author | Peter LaFosse <peter@vector35.com> | 2025-10-31 11:19:15 -0400 |
|---|---|---|
| committer | Glenn Smith <glenn@vector35.com> | 2026-01-28 22:50:07 -0500 |
| commit | 2099579041340399246976046395863741933136 (patch) | |
| tree | bd2e5cc337ed2381e7b43409e9aca92a724ad8fa /python/highlevelil.py | |
| parent | fd8eeb4cc6a4ba19631ef787b3fc505ae2b1eef8 (diff) | |
Fix a fundamental problem with TypeBuilder.handle by deleting it
TypeBuilder.handle creates an immutable_type gets the handle and then deletes the object to which the handle belonged to.
This was fundamentally a UAF. immutable_copy is an error prone api as its very easy to misuse. We should consider a re-architecture of this API. `TypeBuilder.immutable_copy().<anything>` or `Type.mutable_copy().<anything>` should be considered sketchy and immutable_copy().handle is just a straight up UAF. Prior to this commit the following would cause a crash:
current_data_variable.type = PointerBuilder.create(FunctionType.create())
Diffstat (limited to 'python/highlevelil.py')
| -rw-r--r-- | python/highlevelil.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/python/highlevelil.py b/python/highlevelil.py index e16ab760..bb1f6129 100644 --- a/python/highlevelil.py +++ b/python/highlevelil.py @@ -4816,8 +4816,8 @@ class HighLevelILFunction: """ if isinstance(expr_type, str): (expr_type, _) = self.view.parse_type_string(expr_type) - tc = expr_type._to_core_struct() - core.BNSetHighLevelILExprType(self.handle, expr_index, tc) + ic = expr_type.immutable_copy() + core.BNSetHighLevelILExprType(self.handle, expr_index, ic._to_core_struct()) class HighLevelILBasicBlock(basicblock.BasicBlock): |