Branch: refs/heads/bbiiggppiigg/fix-proccontrol-exit-uaf
Home: https://github.com/dyninst/dyninst
Commit: 949bf3a40dd1fba4ef0e46e86b81061d49356eff
https://github.com/dyninst/dyninst/commit/949bf3a40dd1fba4ef0e46e86b81061d49356eff
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
Log Message:
-----------
proccontrol: fix UAF in infMalloc across the RPC wait
int_process::infMalloc cached raw int_process* in active_mallocs, ran the
inferior-malloc RPCs via waitAndHandleEvents(), then dereferenced those
raw pointers (getPid/setLastError/memory/proc) afterward. The RPC runs
the target, so it can exit and be deleted during the wait, dangling the
raw pointer. The sibling infFree already does this safely (Process::ptr
+ re-derive llproc() + NULL-check); mirror it in infMalloc.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: 448dbd9e239a0f68051dce3b350db02bcd75592e
https://github.com/dyninst/dyninst/commit/448dbd9e239a0f68051dce3b350db02bcd75592e
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
Log Message:
-----------
proccontrol: fix UAF in process create/attach bootstrap
int_process::create and int_process::attach snapshotted raw int_process*
in a set and re-dereferenced them across the waitForAsyncEvent /
waitAndHandleEvents / waitfor_startup calls that drive post_create /
post_attach and startup. A process that exits/crashes during bootstrap
is deleted inside those calls (nulling the wrapper's llproc_), leaving
the raw pointer dangling -- e.g. attach even read proc->pid after
waitfor_startup had already deleted proc.
Hold Process::ptr wrappers and re-derive llproc() after each event call,
skipping any process that was freed. Also fixes a latent infinite loop
in attach's plat_attachThreadsSync loop (an errorstate 'continue' that
never advanced the iterator).
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: a3a2fc0168e9fbff2796e97a50282073cf4ffc62
https://github.com/dyninst/dyninst/commit/a3a2fc0168e9fbff2796e97a50282073cf4ffc62
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/procset.C
Log Message:
-----------
proccontrol: fix UAF in LWPTrackingSet::refreshLWPs
refreshLWPs held raw int_process* in all_procs/change_procs and
re-dereferenced them after waitForAsyncEvent and waitAndHandleEvents; a
process deleted during either wait left the raw pointer dangling. Hold
Process::ptr wrappers and re-derive llproc()/getLWPTracking() after each
wait, skipping any freed process.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: 49da9d98a16e865cc224705c7e29ce0be8aeb523
https://github.com/dyninst/dyninst/commit/49da9d98a16e865cc224705c7e29ce0be8aeb523
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
M proccontrol/src/procset.C
Log Message:
-----------
proccontrol: fix UAF in breakpoint install across async waits
addBreakpointWorker cached raw int_process* in bp_installs and called
addBreakpoint_phase2/phase3 on them after two waitForAsyncEvent calls;
sw_breakpoint::create likewise held its int_process* argument across the
memory/result waits. A process that exits during breakpoint installation
is deleted inside those waits, dangling the pointer. Carry Process::ptr
(worker set + its three callers) and re-derive llproc() after each wait,
and in sw_breakpoint::create check the process wrapper's liveness after
each wait, bailing if it exited.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Compare: https://github.com/dyninst/dyninst/compare/949bf3a40dd1%5E...49da9d98a16e
To unsubscribe from these emails, change your notification settings at https://github.com/dyninst/dyninst/settings/notifications
|