mirror of
https://github.com/nmap/nmap.git
synced 2025-12-06 04:31:29 +00:00
69e1295384
referencing deallocated memory.
The class was defined basically as follows:
class ScriptResult
{
private:
std::string output;
public:
std::string get_output() const
{
return this->output;
}
};
The problem was when it was used like this, as in our script output
routines:
const char *s = sr.get_output().c_str();
printf("%s\n", s);
The reason is that the temporary std::string returned by get_output goes
out of scope after the line containing it, which invalidates the memory
pointed to by c_str(). By the time of the printf, s may be pointing to
deallocated memory.
This could have been fixed by returning a const reference that would
remain valid as long as the ScriptResult's output member is valid:
const std::string& get_output() const
{
return this->output;
}
However I noticed that get_output() was always immediately followed by a
c_str(), so I just had get_output return that instead, which has the
same period of validity.
This problem became visiable when compiling with Visual C++ 2010. The
first four bytes of script output in normal output would be garbage
(probably some kind of free list pointer). It didn't happen in XML
output, because the get_output-returned string happened to remain in
scope during that.
66 lines
1.4 KiB
C++
66 lines
1.4 KiB
C++
#ifndef NMAP_LUA_H
|
|
#define NMAP_LUA_H
|
|
|
|
#include <vector>
|
|
#include <list>
|
|
#include <string>
|
|
#include <string.h>
|
|
#include <iostream>
|
|
|
|
extern "C" {
|
|
#include "lua.h"
|
|
#include "lauxlib.h"
|
|
#include "lualib.h"
|
|
}
|
|
|
|
#include "nmap.h"
|
|
#include "global_structures.h"
|
|
|
|
class ScriptResult
|
|
{
|
|
private:
|
|
std::string output;
|
|
std::string id;
|
|
public:
|
|
void set_output (const char *);
|
|
const char *get_output (void) const;
|
|
void set_id (const char *);
|
|
const char *get_id (void) const;
|
|
};
|
|
|
|
typedef std::list<ScriptResult> ScriptResults;
|
|
|
|
/* Call this to get a ScriptResults object which can be
|
|
* used to store Pre-Scan and Post-Scan script Results */
|
|
ScriptResults *get_script_scan_results_obj (void);
|
|
|
|
class Target;
|
|
|
|
|
|
/* API */
|
|
int nse_yield (lua_State *, int, lua_CFunction);
|
|
void nse_restore (lua_State *, int);
|
|
void nse_destructor (lua_State *, char);
|
|
void nse_base (lua_State *);
|
|
void nse_selectedbyname (lua_State *);
|
|
void nse_gettarget (lua_State *, int);
|
|
|
|
void open_nse (void);
|
|
void script_scan (std::vector<Target *> &targets, stype scantype);
|
|
void close_nse (void);
|
|
|
|
#define SCRIPT_ENGINE "NSE"
|
|
|
|
#ifdef WIN32
|
|
# define SCRIPT_ENGINE_LUA_DIR "scripts\\"
|
|
# define SCRIPT_ENGINE_LIB_DIR "nselib\\"
|
|
#else
|
|
# define SCRIPT_ENGINE_LUA_DIR "scripts/"
|
|
# define SCRIPT_ENGINE_LIB_DIR "nselib/"
|
|
#endif
|
|
|
|
#define SCRIPT_ENGINE_DATABASE SCRIPT_ENGINE_LUA_DIR "script.db"
|
|
#define SCRIPT_ENGINE_EXTENSION ".nse"
|
|
|
|
#endif
|