Stack based UAF | Together C & C++ | Page 1

jolly briar Nov 12, 2024, 4:28 PM

#

Does anyone know why this happens and how I can fix this stack UAF?:

Object B constructs
Object A constructs and creates something on Object B
...
Object B gets destroyed on shutdown
Object A attempts to release what it allocated on Object B... BOOM

This is unusal since Object B is constructed first.

mossy compassBOT Nov 12, 2024, 4:28 PM

#

When your question is answered use !solved to mark the question as resolved.

Remember to ask specific questions, provide necessary details, and reduce your question to its simplest form. For tips on how to ask a good question use !howto ask.

heady mirage Nov 12, 2024, 4:29 PM

#

shared_ptr 😄

jolly briar Nov 12, 2024, 4:30 PM

#

heady mirage shared_ptr 😄

Looking to solve without allocating on the heap

jolly briar Nov 12, 2024, 4:30 PM

#

heady mirage shared_ptr 😄

Object B is stack allocated

heady mirage Nov 12, 2024, 4:31 PM

#

heritance ?

fast jetty Nov 12, 2024, 4:31 PM

#

so maybe you could try this #cpp-help-text message

#

mostly to figure out if that is indeed the problem

#

because normally, if the local variable engine gets constructed after the local variable physicsEngine, then it should get destroyed first

jolly briar Nov 12, 2024, 4:45 PM

#

fast jetty so maybe you could try this https://discord.com/channels/331718482485837825/3317...

Now no segfault on exit, but what I had to do to get it to compile this way made sure the rest of the program didn't run

fast jetty Nov 12, 2024, 4:53 PM

#

how so?

jolly briar Nov 12, 2024, 4:53 PM

#

the entire update loop and rendering expects engine to be present

fast jetty Nov 12, 2024, 4:53 PM

#

ah, but couldn't you move that into this new function too?

jolly briar Nov 12, 2024, 4:54 PM

#

i'll try that them

#

*then

fast jetty Nov 12, 2024, 4:54 PM

#

like, all I wanted to do was to make sure that engine gets destructed before physicsEngine, such that you can clearly see in a debugger when each step happens

jolly briar Nov 12, 2024, 4:55 PM

#

Oh wait, know I know what you mean, I just put the engine creation and loop in a scope

fast jetty Nov 12, 2024, 4:57 PM

#

yeah

jolly briar Nov 12, 2024, 5:03 PM

#

fast jetty yeah

I added that it still crashed, I noticed null checks were missing, I added those and now it works without scope. But for anyone trying to read this in the future. The scope can work to fix this.

fast jetty Nov 12, 2024, 5:04 PM

#

but so the problem wasn't actually related to scoped or order of destruction, but to missing null checks?

jolly briar Nov 12, 2024, 5:04 PM

#

yeah. but the debugger decided to not show me that.

fast jetty Nov 12, 2024, 5:04 PM

#

yeah I figured

jolly briar Nov 12, 2024, 5:04 PM

#

but after scope, it showed me everything

#Stack based UAF