search

n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
65 stars 24 forks source link

fix: retaining ownership of an array instead of returning a dangling pointer #80

Closed daladim closed 1 year ago

daladim commented 1 year ago

ENABLE_TRACE_PARAMETERS has a pointer (A) to an array of EVENT_FILTER_DESCRIPTORs, which contains pointers (B) themselves. I cared about the lifetime of pointers A and B, but forgot about the lifetime of the array, which was actually dropped very soon :-(

Now this array is owned by EnableTraceParameters, which fixes this dangling pointer issue.

This bug could lead to failing enabling providers, with EtwNativeError(IoError(Os { code: 87, kind: InvalidInput, message: "The parameter is incorrect." }))

daladim commented 1 year ago

FYI, this bug was introduced in c190b6ec02e08f38584755a5ddc8f89edaa7ce76

n4r1b commented 1 year ago

@daladim feel free to merge PRs when you consider it ready/necessary, as I'll be afk the next few weeks!

daladim commented 1 year ago

All right, I'll merge the current MRs then, thanks.

I'll also make a MR to merge next_major_version into master, because it is now stable enough and the public API of this branch looks fine to my eyes :)