microsoft / Detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
MIT License
5.01k stars 979 forks source link

Document pointer lifetime requirement. #208

Closed Lectem closed 2 years ago

Lectem commented 2 years ago

Describe the bug

It is not documented that we must keep the ppPointer argument of a call to DetourAttach/DetourAttachEx until the transaction is finished (that is, DetourTransactionCommit, DetourTransactionCommitEx or DetourTransactionAbort is called. This can easily lead to use after free (for example if you pass a local variable for the address, which can easily happen if you do not actually use it afterward).

I think this can easily be fixed by adding the following text in the wiki documentation of DetourAttach/DetourAttachEx, in the Remarks section:

Note that the variable pointed to by ppPointer must be alive during the whole transaction, that is until DetourTransactionCommit, DetourTransactionCommitEx or DetourTransactionAbort is called.

bgianfo commented 2 years ago

That's a great suggestion, I've made the proposed wording changes to the DetourAttach and DetourAttachEx wiki pages.

See:

Thanks! 👍