toxcore icon indicating copy to clipboard operation
toxcore copied to clipboard

possibly realloc 0 size and cause uaf

Open yebeloved opened this issue 9 years ago • 1 comments

I think it may cause a potential bug in list.c if bs_list_trim is called and list->n is 0. Because in such condition, when resize being called, p = realloc(list->ids, sizeof(int) * new_size); acts like free function but list->data still points to the freed memory. It may cause use-after-free. Although bs_list_trim hasn't been called now, I think it is a potential issue and we could add some check to make the code safer. Thanks.

yebeloved avatar May 22 '16 12:05 yebeloved

If list->n == 0, then list->data will never be accessed.

iphydf avatar Aug 20 '16 18:08 iphydf