Skip to content

Use-after-free bugs in the pub functions #15

Open
@quitbug

Description

@quitbug

Hi, I've noticed three dangling pointer issues in the below functions, which could lead to use-after-free bugs.

pub fn history_add(line: &str) -> i32 {
let cs = CString::new(line).unwrap().as_ptr();
let ret: i32;
unsafe {
ret = ffi::linenoiseHistoryAdd(cs);
}
ret
}

rust-linenoise/src/lib.rs

Lines 108 to 115 in 7ba975c

pub fn history_save(file: &str) -> i32 {
let fname = CString::new(file).unwrap().as_ptr();
let ret: i32;
unsafe {
ret = ffi::linenoiseHistorySave(fname);
}
ret
}

rust-linenoise/src/lib.rs

Lines 118 to 125 in 7ba975c

pub fn history_load(file: &str) -> i32 {
let fname = CString::new(file).unwrap().as_ptr();
let ret: i32;
unsafe {
ret = ffi::linenoiseHistoryLoad(fname);
}
ret
}

All three functions are due to a same line of code: let fname = CString::new(file).unwrap().as_ptr();.

Suggested fix:
put the above code in the same statement of the FFI call, like ffi::linenoiseHistorySave(CString::new(file).unwrap().as_ptr());

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions