mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-10-29 01:38:37 -04:00
Nic BoetandClaude Opus 5.5
2f7ace2c2f
MonitorLinkExpression kept a string_view of the string it was built from, Monitor::linked_monitors_string, and the tokens parse() builds are views into it. Monitor::Reload() calls Load(), which reassigns that string without re-parsing the expression, so once the new value no longer fits the old buffer every token points into freed memory. They are read by the Debug(1, ...) calls in MonitorLinkExpression::visit(), which runs on every analysed frame of a monitor with LinkedMonitors set when its debug level is 1 or more. Copy the string into the expression and point the views at the copy. fixes #5271 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.7 KiB
C++
42 lines
1.7 KiB
C++
/*
|
|
* This file is part of the ZoneMinder Project. See AUTHORS file for Copyright information
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "zm_catch2.h"
|
|
|
|
#include "zm_monitorlink_expression.h"
|
|
|
|
#include <memory>
|
|
#include <string>
|
|
|
|
// Monitor::Load() reassigns linked_monitors_string on every reload while the
|
|
// MonitorLinkExpression built from it lives on, so the expression and the
|
|
// tokens it parses must not point into the caller's string. Only delimiters
|
|
// here: a monitor id token would load that monitor from the database. The
|
|
// string is longer than the small-string buffer so that it lives on the heap;
|
|
// before the fix AddressSanitizer reports a heap-use-after-free in parse().
|
|
TEST_CASE("MonitorLinkExpression does not refer to the caller's string", "[MonitorLink]") {
|
|
std::unique_ptr<MonitorLinkExpression> expression;
|
|
{
|
|
std::string linked = "((((((((((((((((((((((((";
|
|
expression = std::make_unique<MonitorLinkExpression>(linked);
|
|
linked.assign(64, '|');
|
|
}
|
|
REQUIRE(expression->parse());
|
|
MonitorLinkExpression::Result result = expression->result();
|
|
REQUIRE_FALSE(result.success);
|
|
}
|