mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-10 20:19:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gpu_display: fix use after free for the wayland socket path

Browse source 
Using .map in the way it was caused the CString to get moved into the closure
and then dropped by that closure. The returned pointer is then used in
dwl_context_setup after it was freed by the drop.

This change fixes that first by using .as_ref() before calling .map to
prevent the move. As an additional safeguard, some optional types were
added to the closure to make sure a reference to the CString was being
handled instead of a moved CString.

TEST=vmc start --enable-gpu termina
BUG=chromium:988082

Change-Id: I58c2c002f08688ecd85715d9cd45085dffb32457
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1721615
Tested-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Zach Reizner <zachr@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Zach Reizner <zachr@chromium.org>
This commit is contained in:
Zach Reizner 2019-07-26 13:31:55 -07:00 committed by Commit Bot
parent f5285c647a
commit 92e75f0e2a
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
gpu_display/src/gpu_display_wl.rs
View file

@ -111,8 +111,14 @@ impl DisplayWl {
Some(None) => return Err(GpuDisplayError::InvalidPath),
None => None,
};
let setup_success =
unsafe { dwl_context_setup(ctx.0, cstr_path.map(|s| s.as_ptr()).unwrap_or(null())) };
// This grabs a pointer to cstr_path without moving the CString into the .map closure
// accidentally, which triggeres a really hard to catch use after free in
// dwl_context_setup.
let cstr_path_ptr = cstr_path
.as_ref()
.map(|s: &CString| CStr::as_ptr(s))
.unwrap_or(null());
let setup_success = unsafe { dwl_context_setup(ctx.0, cstr_path_ptr) };
if !setup_success {
return Err(GpuDisplayError::Connect);
}