diff options
| author | Peter LaFosse <peter@vector35.com> | 2025-10-31 11:19:15 -0400 |
|---|---|---|
| committer | Glenn Smith <glenn@vector35.com> | 2026-01-28 22:50:07 -0500 |
| commit | 2099579041340399246976046395863741933136 (patch) | |
| tree | bd2e5cc337ed2381e7b43409e9aca92a724ad8fa /python/mediumlevelil.py | |
| parent | fd8eeb4cc6a4ba19631ef787b3fc505ae2b1eef8 (diff) | |
Fix a fundamental problem with TypeBuilder.handle by deleting it
TypeBuilder.handle creates an immutable_type gets the handle and then deletes the object to which the handle belonged to.
This was fundamentally a UAF. immutable_copy is an error prone api as its very easy to misuse. We should consider a re-architecture of this API. `TypeBuilder.immutable_copy().<anything>` or `Type.mutable_copy().<anything>` should be considered sketchy and immutable_copy().handle is just a straight up UAF. Prior to this commit the following would cause a crash:
current_data_variable.type = PointerBuilder.create(FunctionType.create())
Diffstat (limited to 'python/mediumlevelil.py')
| -rw-r--r-- | python/mediumlevelil.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 6377996b..84ef1382 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -6350,7 +6350,8 @@ class MediumLevelILFunction: if expr_type is not None: if isinstance(expr_type, str): (expr_type, _) = self.view.parse_type_string(expr_type) - tc = expr_type._to_core_struct() + ic = expr_type.immutable_copy() + tc = ic._to_core_struct() else: tc = core.BNTypeWithConfidence() tc.type = None |