Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

invalid free in cmd_info.c:cmd_info() #16303

Closed
aar0nge opened this issue Mar 25, 2020 · 1 comment · Fixed by #16318
Closed

invalid free in cmd_info.c:cmd_info() #16303

aar0nge opened this issue Mar 25, 2020 · 1 comment · Fixed by #16318

Comments

@aar0nge
Copy link
Contributor

aar0nge commented Mar 25, 2020

Work environment

Questions Answers
OS/arch/bits (mandatory) Ubuntu x86 64
File format of the file you reverse (mandatory) ELF
Architecture/bits of the file (mandatory) x86/64
r2 -v full output, not truncated (mandatory) rradare2 4.3.1 23909 @ linux-x86-64 git.4.3.1-1-ge55661b commit: e55661b build: 2020-03-22__22:18:20

Expected behavior

Handle input error

Actual behavior

double free/invalid pointer to free

Steps to reproduce the behavior

$ r2 -
[0x00000000]> in 0
[0x00000000]> oc 0
[0x00000000]> in 0
*** Error in `r2': free(): invalid pointer: 0x00007fffed1bcd00 ***
……

Additional Logs, screenshots, source-code, configuration dump, ...

image
The in command would first free the original core->table_query, then create a new core->table_query in cmd_info.c:cmd_info()

	R_FREE (core->table_query);
	if (space && *space == ' ') {
		core->table_query = r_str_trim_dup (space + 1);
	}

The oc command would free it in core.c: r_core_fini, which didn't NULL it out.

……
	free (c->table_query);
	r_list_free (c->files);
	r_list_free (c->watchers);
	r_list_free (c->scriptstack);
……

So execute in 0 again would cause a double/invalid free.

@radare
Copy link
Collaborator

radare commented Mar 25, 2020 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants