Opened 2 years ago

Closed 2 years ago

#27803 closed defect (not a bug)

rust protover_all_supported() double-free of *missing_out

Reported by: teor Owned by:
Priority: Medium Milestone: Tor: 0.3.5.x-final
Component: Core Tor/Tor Version: Tor:
Severity: Normal Keywords: rust, protover, memory-safety, 035-must, fast-fix, 033-backport, 034-backport
Cc: Actual Points:
Parent ID: #27740 Points:
Reviewer: Sponsor:


*missing_out is allocated in Rust, deallocated in Rust (when the function returns), used in C, and then freed in C

Child Tickets

Change History (2)

comment:1 in reply to:  description Changed 2 years ago by cyberpunks

That's not true. The code calls CString::into_raw() to prevent a double-free.

comment:2 Changed 2 years ago by teor

Resolution: not a bug
Status: newclosed
Note: See TracTickets for help on using tickets.