-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
possibly realloc 0 size and cause uaf #1578
Comments
If |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I think it may cause a potential bug in list.c if
bs_list_trim
is called andlist->n
is 0. Because in such condition, whenresize
being called,p = realloc(list->ids, sizeof(int) * new_size);
acts like free function butlist->data
still points to the freed memory. It may cause use-after-free.Although
bs_list_trim
hasn't been called now, I think it is a potential issue and we could add some check to make the code safer. Thanks.The text was updated successfully, but these errors were encountered: