From b9d1130f3c5eb018b50e3b3aeb5993e75001df29 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Tue, 23 Jul 2019 15:40:54 -0400 Subject: Fix DataBuffer UAF in Transform Python API. --- python/transform.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'python/transform.py') diff --git a/python/transform.py b/python/transform.py index 95aeac87..6d72f3cc 100644 --- a/python/transform.py +++ b/python/transform.py @@ -246,10 +246,11 @@ class Transform(with_metaclass(_TransformMetaClass, object)): output_buf = databuffer.DataBuffer() keys = list(params.keys()) param_buf = (core.BNTransformParameter * len(keys))() + data = [] for i in range(0, len(keys)): - data = databuffer.DataBuffer(params[keys[i]]) + data.append(databuffer.DataBuffer(params[keys[i]])) param_buf[i].name = keys[i] - param_buf[i].value = data.handle + param_buf[i].value = data[i].handle if not core.BNDecode(self.handle, input_buf.handle, output_buf.handle, param_buf, len(keys)): return None return str(output_buf) @@ -261,10 +262,11 @@ class Transform(with_metaclass(_TransformMetaClass, object)): output_buf = databuffer.DataBuffer() keys = list(params.keys()) param_buf = (core.BNTransformParameter * len(keys))() + data = [] for i in range(0, len(keys)): - data = databuffer.DataBuffer(params[keys[i]]) + data.append(databuffer.DataBuffer(params[keys[i]])) param_buf[i].name = keys[i] - param_buf[i].value = data.handle + param_buf[i].value = data[i].handle if not core.BNEncode(self.handle, input_buf.handle, output_buf.handle, param_buf, len(keys)): return None return str(output_buf) -- cgit v1.3.1