search

ucsb-seclab / dr_checker

DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers
BSD 2-Clause "Simplified" License
329 stars 71 forks source link

Memory leakage and double free #34

Open Lawliar opened 4 years ago

Lawliar commented 4 years ago

Good work but the allocated memory seems handled not very well, there are a few memory errors.

  1. double free https://github.com/ucsb-seclab/dr_checker/blob/speedy/llvm_analysis/MainAnalysisPasses/SoundyAliasAnalysis/include/AliasObject.h#L251 This line only free the memory, the vector still has the element.

  2. Memory leaking https://github.com/ucsb-seclab/dr_checker/blob/speedy/llvm_analysis/MainAnalysisPasses/SoundyAliasAnalysis/include/ModuleState.h#L131

Lawliar commented 4 years ago

For the double free, although the vector is cleared after the delete operation, a double free is still triggered when cleaning up the global state.

Any help is appreciated.