It is not documented that we must keep the ppPointer argument of a call to DetourAttach/DetourAttachEx until the transaction is finished (that is, DetourTransactionCommit, DetourTransactionCommitEx or DetourTransactionAbort is called.
This can easily lead to use after free (for example if you pass a local variable for the address, which can easily happen if you do not actually use it afterward).
I think this can easily be fixed by adding the following text in the wiki documentation of DetourAttach/DetourAttachEx, in the Remarks section:
Note that the variable pointed to by ppPointer must be alive during the whole transaction, that is until DetourTransactionCommit, DetourTransactionCommitEx or DetourTransactionAbort is called.
Describe the bug
It is not documented that we must keep the
ppPointer
argument of a call toDetourAttach
/DetourAttachEx
until the transaction is finished (that is,DetourTransactionCommit
,DetourTransactionCommitEx
orDetourTransactionAbort
is called. This can easily lead to use after free (for example if you pass a local variable for the address, which can easily happen if you do not actually use it afterward).I think this can easily be fixed by adding the following text in the wiki documentation of
DetourAttach
/DetourAttachEx
, in the Remarks section: