Fix use after free in the CallbackToLogRedirector (#5918)
The heap-use-after-free vulnerability occurs in the CallbackToLogRedirector function. During the process of logging, a previously freed memory region is accessed, leading to a use-after-free condition. This vulnerability stems from incorrect memory management, specifically, freeing a log stream and then attempting to access it later on. This patch sets NULL value for The DefaultStream global pointer. Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
@@ -416,6 +416,10 @@ ASSIMP_API aiReturn aiDetachLogStream(const aiLogStream *stream) {
|
||||
DefaultLogger::get()->detachStream(it->second);
|
||||
delete it->second;
|
||||
|
||||
if ((Assimp::LogStream *)stream->user == DefaultStream) {
|
||||
DefaultStream = nullptr;
|
||||
}
|
||||
|
||||
gActiveLogStreams.erase(it);
|
||||
|
||||
if (gActiveLogStreams.empty()) {
|
||||
|
||||
Reference in New Issue
Block a user