Skip to content

Fix iterate end linear free - #425

Merged
vstakhov merged 2 commits into
vstakhov:masterfrom
tregua87:fix-iterate-end-linear-free
Oct 7, 2026
Merged

vstakhov merged 2 commits into
vstakhov:masterfrom
tregua87:fix-iterate-end-linear-free

Conversation

@tregua87

@tregua87 tregua87 commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Fix #424

tregua87 and others added 2 commits October 7, 2026 13:20
ucl_object_iterate_end frees *it as a hash iterator whenever obj is a
UCL_OBJECT. That is only true for expand_values = true. Without it,
ucl_object_iterate_with_error walks obj as a linear list and *it is a
position in that list - obj itself, or one of its next elements - so
abandoning the iteration, as ucl.h documents, frees that object:

    ucl_object_iterate_with_error(obj, &it, false, NULL);  /* it == obj */
    ucl_object_iterate_end(obj, &it);                      /* frees obj */
    ucl_object_unref(obj);                                 /* use-after-free */

Check whether *it is one of the objects in obj's own list before freeing; if
it is, the iterator is a linear position and there is nothing to free. The
list is short and only abandoned iterations reach this code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W3aXdPKAnVwjiNtZstnmPj

@vstakhov vstakhov left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Reproduced the heap-use-after-free from #424 on master under ASan; all variants run clean on this branch.

@vstakhov
vstakhov merged commit ef7d2c2 into vstakhov:master Oct 7, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ucl_object_iterate_end() frees the object when the iteration was not expanding values

2 participants