From 2099579041340399246976046395863741933136 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Fri, 31 Oct 2025 11:19:15 -0400 Subject: Fix a fundamental problem with TypeBuilder.handle by deleting it TypeBuilder.handle creates an immutable_type gets the handle and then deletes the object to which the handle belonged to. This was fundamentally a UAF. immutable_copy is an error prone api as its very easy to misuse. We should consider a re-architecture of this API. `TypeBuilder.immutable_copy().` or `Type.mutable_copy().` should be considered sketchy and immutable_copy().handle is just a straight up UAF. Prior to this commit the following would cause a crash: current_data_variable.type = PointerBuilder.create(FunctionType.create()) --- python/highlevelil.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'python/highlevelil.py') diff --git a/python/highlevelil.py b/python/highlevelil.py index e16ab760..bb1f6129 100644 --- a/python/highlevelil.py +++ b/python/highlevelil.py @@ -4816,8 +4816,8 @@ class HighLevelILFunction: """ if isinstance(expr_type, str): (expr_type, _) = self.view.parse_type_string(expr_type) - tc = expr_type._to_core_struct() - core.BNSetHighLevelILExprType(self.handle, expr_index, tc) + ic = expr_type.immutable_copy() + core.BNSetHighLevelILExprType(self.handle, expr_index, ic._to_core_struct()) class HighLevelILBasicBlock(basicblock.BasicBlock): -- cgit v1.3.1