tseli0s/nvdialog

[BUG] Windows code returns a pointer to the stack, Mac has a use after free

Opened this issue · 1 comments

rj45 commented

The dialog struct has the filename set to a pointer to stack memory:

char file[NVDIALOG_MAXBUF];

Then at the end of the function, the pointer is returned without copying the memory to the heap:

dialog->filename = ofn.lpstrFile;
dialog->location_was_chosen = true;
*savebuf = dialog->filename;

There's a similar issue with the Mac version where the memory for the filename string will be freed before the function returns. In both cases I had to strdup() the string and return that.

The gtk version and sandbox version both correctly strdup() the filename. I don't fully understand the adw code but it looks like it might also be missing a strdup().

The dialog struct has the filename set to a pointer to stack memory:

We no longer use the backend-specific implementations on any backend. See src/impl/nvdialog_typeimpl.h, that's where the types are implemented now. In other words, you're looking at the wrong type.

I don't know about the macos backend (Are you talking about #55 ?), but the backend for MacOS is generally abandoned due to lack of maintainers.