From acc7a74a2c72dd32d8b17f3e13a06a4268bd0c73 Mon Sep 17 00:00:00 2001 From: Nick Alcock Date: Mon, 29 Jul 2024 12:45:09 +0100 Subject: [PATCH] libctf: fix ref leak of names of newly-inserted non-root-visible types A bug in ctf_dtd_delete led to refs in the string table to the names of non-root-visible types not being removed when the DTD was. This seems harmless, but actually it would lead to a write down a pointer into freed memory if such a type was ctf_rollback()ed over and then the dict was serialized (updating all the refs as the strtab was serialized in turn). Bug introduced in commit fe4c2d55634c700ba527ac4183e05c66e9f93c62 ("libctf: create: non-root-visible types should not appear in name tables") which is included in binutils 2.35. libctf/ * ctf-create.c (ctf_dtd_delete): Remove refs for all types with names, not just root-visible ones. --- libctf/ctf-create.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libctf/ctf-create.c b/libctf/ctf-create.c index 808da372de8..a166f09df13 100644 --- a/libctf/ctf-create.c +++ b/libctf/ctf-create.c @@ -651,11 +651,11 @@ ctf_dtd_delete (ctf_file_t *fp, ctf_dtdef_t *dtd) } if (dtd->dtd_data.ctt_name - && (name = ctf_strraw (fp, dtd->dtd_data.ctt_name)) != NULL - && LCTF_INFO_ISROOT (fp, dtd->dtd_data.ctt_info)) + && (name = ctf_strraw (fp, dtd->dtd_data.ctt_name)) != NULL) { - ctf_dynhash_remove (ctf_name_table (fp, name_kind)->ctn_writable, - name); + if (LCTF_INFO_ISROOT (fp, dtd->dtd_data.ctt_info)) + ctf_dynhash_remove (ctf_name_table (fp, name_kind)->ctn_writable, + name); ctf_str_remove_ref (fp, name, &dtd->dtd_data.ctt_name); } -- 2.39.5