From b4352a00a5b8a11382b394fa3e668878a14461c6 Mon Sep 17 00:00:00 2001 From: Dhruv Chawla Date: Tue, 10 Jun 2025 09:38:54 -0700 Subject: [PATCH 1/2] Fix use-after-free in CreatePerfDataReader This patch fixes a use-after-free that was causing a memory corruption error. The filenames set would be created, written into, then copied into a vector of string_view. After the scope exit, the string_views were read and would have dangling references to the destroyed set. --- spe_sample_reader.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spe_sample_reader.cc b/spe_sample_reader.cc index 3f720f0..109aea3 100644 --- a/spe_sample_reader.cc +++ b/spe_sample_reader.cc @@ -162,6 +162,7 @@ absl::StatusOr PerfSpeDataSampleReader::CreatePerfDataReader( ASSIGN_OR_RETURN(PerfDataProvider::BufferHandle perf_data, FetchPerfData(profile_file)); + std::set filenames; std::vector match_mmap_names; // Only use the mmap name regex if there is no build_id. if (binary_content.build_id.empty()) { @@ -174,7 +175,6 @@ absl::StatusOr PerfSpeDataSampleReader::CreatePerfDataReader( reader.ReadFromPointer(perf_data.buffer->getBufferStart(), perf_data.buffer->getBufferSize()); - std::set filenames; reader.GetFilenamesAsSet(&filenames); // Filter out filenames that don't match the regex. absl::c_copy_if(filenames, std::back_inserter(match_mmap_names), From 12283594ffdaf19829eed6d4f441978e4101aa5a Mon Sep 17 00:00:00 2001 From: Dhruv Chawla Date: Tue, 10 Jun 2025 09:38:54 -0700 Subject: [PATCH 2/2] Fix uninitialized variable warnings from valgrind --- util/symbolize/elf_reader.cc | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/util/symbolize/elf_reader.cc b/util/symbolize/elf_reader.cc index f6a0a2e..9787c11 100644 --- a/util/symbolize/elf_reader.cc +++ b/util/symbolize/elf_reader.cc @@ -657,32 +657,32 @@ class ElfReaderImpl { friend class SymbolIterator; // The file we're reading. - const string path_; + const string path_ {}; // Open file descriptor for path_. Not owned by this object. - const int fd_; + const int fd_ {}; // The global header of the ELF file. - typename ElfArch::Ehdr header_; + typename ElfArch::Ehdr header_ {}; // The header of the first section. This may be used to supplement the ELF // file header. - typename ElfArch::Shdr first_section_header_; + typename ElfArch::Shdr first_section_header_ {}; // Array of GetNumSections() section headers, allocated when we read // in the global header. - typename ElfArch::Shdr *section_headers_; + typename ElfArch::Shdr *section_headers_ {}; // Array of GetNumProgramHeaders() program headers, allocated when we read // in the global header. - typename ElfArch::Phdr *program_headers_; + typename ElfArch::Phdr *program_headers_ {}; // An array of pointers to ElfSectionReaders. Sections are // mmaped as they're needed and not released until this object is // destroyed. - vector*> sections_; + vector*> sections_ {}; // True if this is a .dwp file. - bool is_dwp_; + bool is_dwp_ {}; DISALLOW_EVIL_CONSTRUCTORS(ElfReaderImpl); };