radareorg / radare2-bindings

Bindings of the r2 api for Valabind and friends
GNU Lesser General Public License v3.0
130 stars 92 forks source link

Fix use-after-free bug in py_disassemble #212

Closed aronsky closed 5 years ago

aronsky commented 5 years ago

opstr points to a string under Python control, which can be released before its value is copied into op->buf_asm (due to the call to Py_DECREF prior to calling r_strbuf_set).

The fix copies the value immediately, before decrementing Python's ref counter.