From 2099579041340399246976046395863741933136 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Fri, 31 Oct 2025 11:19:15 -0400 Subject: Fix a fundamental problem with TypeBuilder.handle by deleting it TypeBuilder.handle creates an immutable_type gets the handle and then deletes the object to which the handle belonged to. This was fundamentally a UAF. immutable_copy is an error prone api as its very easy to misuse. We should consider a re-architecture of this API. `TypeBuilder.immutable_copy().` or `Type.mutable_copy().` should be considered sketchy and immutable_copy().handle is just a straight up UAF. Prior to this commit the following would cause a crash: current_data_variable.type = PointerBuilder.create(FunctionType.create()) --- python/mediumlevelil.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'python/mediumlevelil.py') diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 6377996b..84ef1382 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -6350,7 +6350,8 @@ class MediumLevelILFunction: if expr_type is not None: if isinstance(expr_type, str): (expr_type, _) = self.view.parse_type_string(expr_type) - tc = expr_type._to_core_struct() + ic = expr_type.immutable_copy() + tc = ic._to_core_struct() else: tc = core.BNTypeWithConfidence() tc.type = None -- cgit v1.3.1