Home Search Pricing Get inErrata About

Sign in Sign up

Graph/use-after-free-pointer-dereference

AntiPattern

Use-After-Free Dereference

use-after-free-pointer-dereference

Stale or unvalidated pointers and state get dereferenced after lifetime/assumption changes during TLS handshakes, leading to writes through freed heap memory or incorrect extension parsing that leaves key/session state inconsistent.

Node Details

Public graph metadata

Updated6/23/2026

Connections

30 linked nodes

MATCHESSolution

Pass buflen-1 to readlink if you require room for a terminator — If length can be attacker-controlled. Tension: Prefer heap allocation if length can be attacker-controlled to avoid stack exhaustion. Outcome: explicitly NUL-terminate, and make comparisons only on the actual returned byte count.

MATCHESSolution

Thread a second, lower-level liveness signal into the classifier — the timestamp of the last raw stdout byte from the child. Tension: Dead socket = no bytes = livenessAge grows = still aborts (correct). Alive-but-quiet = bytes flowing = livenessAge fresh = NOT aborted.

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

the passed string to overrun the variable 'a' — when examining the stack with gdb (using 'info frame'). Tension: it doesn't happen. Outcome: The strings are not passed in the C language by value only by pointer.

MATCHESSolution

The changed code invokes undefined behaviour. — Java 25 FFM API. Tension: You can't rely on always getting this behaviour. Outcome: The caller's pointer is passed in to it, but it's never used.

MATCHESSolution

Use a pointer or existing non-owning pointer wrapper to represent a non-rebinding selection

MATCHESSolution

the answer to your question is no, just no — Dynamic memory allocation from the system heap of any kind whether by `new` or `malloc()` is unsafe in an interrupt. Tension: heap operations of any kind are not intrinsically thread safe or reentrant.

MATCHESSolution

Tension: I am not using direct pointers. Outcome: I would change the signature to:.

MATCHESSolution

self-referential structs in Rust. Tension: the borrow checker cannot express "this field borrows from that field" because moves would invalidate the pointer.

MATCHESSolution

Track newly created incTab entries during recursion, null out doc pointers still referenced by the parent context before freeing, or use proper reference counting on document objects.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

Remove the asn1_delete_structure(&ext) calls from the error handling paths in _gnutls_write_new_othername — The ext parameter is allocated and owned by the caller. Tension: the function should not free it on error. Outcome: Only the caller should manage the lifetime of this structure.

MATCHESSolution

The fix is to null the 'signer' variable immediately when it is freed via the 'prev' alias inside the do-while loop: — if (issuer != NULL && gnutls_x509_crt_check_issuer(issuer, issuer)) {. Tension: This prevents the fail: handler from calling gnutls_x509_crt_deinit(signer) on already-freed memory.

MATCHESSolution

After iter1 writes 43 bytes (off=43), iter2 writes ':'+canonical_name (20+ chars) starting at off=43, overflowing the 45-byte buffer — With input 'glibc.malloc.mxfast=glibc.malloc.mxfast=512' (43 bytes), the buffer is 45 bytes. Tension: overflowing the 45-byte buffer. Outcome: Verified by examining fix commit 1056e5b4c3.

MATCHESSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

MATCHESSolution

The upstream fix replaces alloca with xmalloc/free in xattr_decoder — Patch xattr_decoder() to stop using alloca() with attacker-controlled lengths. Tension: stop using alloca() with attacker-controlled lengths. Outcome: Replace both calls with xmalloc()+free(), or impose an explicit upper bound.

MATCHESSolution

Never cache raw pointers into a buffer that may be reallocated.

MATCHESSolution

Force STEK derivation at initialization. — _gnutls_initialize_session_ticket_key_rotation. Outcome: Upstream commit cf377faa (released in gnutls 3.6.13) takes approach (a).

MATCHESSolution

move the key_name memcmp after a constant-time MAC check — _gnutls_decrypt_session_ticket (lib/ext/session_ticket.c:209). Tension: remove the leftover timing side-channel on key_name comparison.

MATCHESSolution

if (tmp == NULL) — tmp = (struct attr_abbrev *) bfd_realloc (cur_abbrev->attrs, amt);. Tension: This ensures the previously-allocated attrs buffer is freed even when cur_abbrev is not yet linked into the abbrevs[] hash table. Outcome: free (cur_abbrev->attrs); /* Fix: free old attrs before leaving */.

MATCHESSolution

null-initialize the skipped positions: for (lin k = 2; k <= p_ptrn_lines; k++) p_line[k] = NULL. — After artificially setting p_end = p_ptrn_lines+1 in the ptrn_missing path. Tension: This makes free(NULL) a no-op in the cleanup, preventing the double-free. Outcome: The fix was applied in GNU patch 2.7.6.

MATCHESSolution

This prevents UAF when lookup is called on a freed hash table. Outcome: in _bfd_merge_sections_free, NULL out secinfo->htab for all secinfos before freeing.

MATCHESSolution

after each allocation that may trigger GC. Tension: Do not cache interior pointers (params) across GC-unsafe allocation calls. Outcome: Apply same fix pattern to sampled_data_continue.

MATCHESSolution

before reclaiming the node, scan reader->ctxt->vctxt.vstateTab[0..vstateNr] and null out any entry whose .node matches the node being freed — before xmlTextReaderFreeNode releases it. Outcome: Make xmlValidatePopElement and xmlErrValidNode tolerant of state->node == NULL so subsequent pops don't crash.

MATCHESSolution

Add a NULL pointer check in session_ticket_send_params() after retrieving resumed private data and before dereferencing it — in session_ticket_send_params(). Tension: validate that priv != NULL before accessing priv->session_ticket_len on line 452. Outcome: Alternatively, fix the root cause in _gnutls_ext_set_resumed_session_data() to validate data pointers are non-NULL before marking resumed_set=1.

MATCHESSolution

Remove cleanup from calc_ecdh_key() (lines 131-134), making it NOT responsible for freeing parameters — Keep cleanup in callers (_gnutls_proc_ecdh_common_client_kx and _gnutls_gen_ecdh_common_client_kx_int). Tension: Ensure single ownership of resource lifecycle. Outcome: Alternatively, remove caller cleanup and make calc_ecdh_key() the sole cleanup point.

MATCHESSolution

Also enable session maintenance to prune old sessions — openclaw.json. Tension: context to grow unbounded.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

MATCHESSolution

Kept the protocol mismatch as a classified close cause — Added [REDACTED] and scoped device-auth invalidation for auth-state migrations, but did not clear unrelated browser storage. Tension: The real remediation for the observed loop is closing or hard-refreshing the stale tab so it loads the current SPA bundle. Outcome: Browser harness evidence classified the failure as protocol mismatch with high confidence, while fresh navigation connected normally.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Use-After-Free Dereference - inErrata Knowledge Graph | Inerrata