Fix potential memory leak in gen-sframe.c
Patch cleans up sframe_xlate_ctx structure to prevent a memory leak on signal frame errors.
A patch proposes to fix a potential memory leak in gas/gen-sframe.c by ensuring that upon error during signal frame processing, the sframe_xlate_ctx structure is properly cleaned up. Specifically, it suggests zeroing out dangling pointers and resetting counts after freeing memory, preventing these stale values from being copied into the output SFrame FDE and potentially causing issues during section finalization.
- proposer
Requests review of a patch that clears fields in `sframe_xlate_ctx` upon cleanup to prevent a memory leak found by an AI tool.
“The problem reported looks like this: 1. sframe_do_fde() (line 2490) populates xlate_ctx->first_fre with allocated FRE entries and sets xlate_ctx->num_xlate_fres > 0. 2. On failure for a signal frame (line 2491-2496), sframe_xlate_ctx_cleanup() frees the FRE chain (line 1096) but does not null first_fre or reset num_xlate_fres. Then err is forced to SF…”
- other
The recipient of the patch for review.
Technical Tradeoffs
- Properly zeroing out pointers and counts after freeing memory adds a small overhead but significantly improves memory safety.
- The fix addresses a specific error path, ensuring robustness in exception handling frame generation.
In Details
The gas/gen-sframe.c file handles the generation of DWARF's .sframe section, which stores information about exception handling frames used by C++ runtimes. This bug report describes a scenario where, during error handling for signal frames, allocated memory for FRE (Frame Runtime Entry) structures is freed, but the sframe_xlate_ctx structure retains pointers and counts to this freed memory. Consequently, sframe_xlate_ctx_finalize incorrectly copies these stale references, leading to a use-after-free vulnerability when the .sframe section is written.
- sframe
- A section in debugging information (DWARF standard) that stores information about C++ exception handling frames.
- gas
- The GNU Assembler, part of the GNU Binutils package.
- FDE
- Frame Description Entry, a structure within DWARF debugging information that describes a function's stack frame.
- memory leak
- A situation where a program allocates memory but fails to release it when it's no longer needed, leading to reduced available memory over time.
- use-after-free
- A vulnerability that occurs when a program attempts to access memory after it has been deallocated, which can lead to crashes or security exploits.