diff options
author | Chuck Ries <chuckr@microsoft.com> | 2018-11-26 22:06:34 -0800 |
---|---|---|
committer | Andrew Au <cshung@gmail.com> | 2018-11-26 22:06:34 -0800 |
commit | 870267fac0b16ac246d6ba01f49ba4c6acd2319c (patch) | |
tree | d3964872401445daf5d0c42f39e69b6c2ab16cc4 /src/debug/di | |
parent | 6af3c5dd51a2e6411d32fdbf2645ec0ea68b36ff (diff) | |
download | coreclr-870267fac0b16ac246d6ba01f49ba4c6acd2319c.tar.gz coreclr-870267fac0b16ac246d6ba01f49ba4c6acd2319c.tar.bz2 coreclr-870267fac0b16ac246d6ba01f49ba4c6acd2319c.zip |
Fix a use after free for Managed Data BP (#21205)
ShimProxyCallback::DataBreakpoint::DataBreakpointEvent was holding onto a bare
BYTE* for the CONTEXT rather than copying the buffer and taking ownership. Due to
lifetime, this resulted in a use after free. Apparently in retail code we got lucky
and this worked enough of the time that we never noticed it.
Diffstat (limited to 'src/debug/di')
-rw-r--r-- | src/debug/di/shimcallback.cpp | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/src/debug/di/shimcallback.cpp b/src/debug/di/shimcallback.cpp index 84ee3454d5..e987f9b944 100644 --- a/src/debug/di/shimcallback.cpp +++ b/src/debug/di/shimcallback.cpp @@ -1392,7 +1392,7 @@ HRESULT ShimProxyCallback::DataBreakpoint(ICorDebugProcess* pProcess, ICorDebugT // callbacks parameters. These are strong references RSExtSmartPtr<ICorDebugProcess> m_pProcess; RSExtSmartPtr<ICorDebugThread> m_pThread; - BYTE* m_pContext; + CONTEXT m_context; ULONG32 m_contextSize; public: @@ -1402,13 +1402,15 @@ HRESULT ShimProxyCallback::DataBreakpoint(ICorDebugProcess* pProcess, ICorDebugT { this->m_pProcess.Assign(pProcess); this->m_pThread.Assign(pThread); - this->m_pContext = pContext; - this->m_contextSize = contextSize; + + _ASSERTE(contextSize == sizeof(CONTEXT)); + this->m_contextSize = min(contextSize, sizeof(CONTEXT)); + memcpy(&(this->m_context), pContext, this->m_contextSize); } HRESULT Dispatch(DispatchArgs args) { - return args.GetCallback4()->DataBreakpoint(m_pProcess, m_pThread, m_pContext, m_contextSize); + return args.GetCallback4()->DataBreakpoint(m_pProcess, m_pThread, reinterpret_cast<BYTE*>(&m_context), m_contextSize); } }; // end class AfterGarbageCollectionEvent |