-
Notifications
You must be signed in to change notification settings - Fork 7
Open
Description
Hi, I've noticed three dangling pointer issues in the below functions, which could lead to use-after-free bugs.
Lines 89 to 96 in 7ba975c
pub fn history_add(line: &str) -> i32 { | |
let cs = CString::new(line).unwrap().as_ptr(); | |
let ret: i32; | |
unsafe { | |
ret = ffi::linenoiseHistoryAdd(cs); | |
} | |
ret | |
} |
Lines 108 to 115 in 7ba975c
pub fn history_save(file: &str) -> i32 { | |
let fname = CString::new(file).unwrap().as_ptr(); | |
let ret: i32; | |
unsafe { | |
ret = ffi::linenoiseHistorySave(fname); | |
} | |
ret | |
} |
Lines 118 to 125 in 7ba975c
pub fn history_load(file: &str) -> i32 { | |
let fname = CString::new(file).unwrap().as_ptr(); | |
let ret: i32; | |
unsafe { | |
ret = ffi::linenoiseHistoryLoad(fname); | |
} | |
ret | |
} |
All three functions are due to a same line of code: let fname = CString::new(file).unwrap().as_ptr();
.
Suggested fix:
put the above code in the same statement of the FFI call, like ffi::linenoiseHistorySave(CString::new(file).unwrap().as_ptr());
Metadata
Metadata
Assignees
Labels
No labels