Fix heap corruption in Rust bindings (#62)

RabbitizerInstruction_getSizeForBuffer and RabbitizerOperandType_getBufferSize return the size _without_ the null terminator, so we need to allocate one more byte to avoid writing past the allocated vector bounds.
Decompollaborate · May 22, 2024 · 4dd2a55 · 4dd2a55
1 parent f5c65d0
commit 4dd2a55
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/rust/src/instruction.rs b/rust/src/instruction.rs
@@ -709,7 +709,7 @@ impl Instruction {
             let buffer_size =
                 RabbitizerInstruction_getSizeForBuffer(self, imm_override_len, extra_l_just);
 
-            let mut buffer: Vec<u8> = vec![0; buffer_size];
+            let mut buffer: Vec<u8> = vec![0; buffer_size + 1];
             let disassembled_size = RabbitizerInstruction_disassemble(
                 self,
                 buffer.as_mut_ptr() as *mut core::ffi::c_char,

diff --git a/rust/src/opereand_type.rs b/rust/src/opereand_type.rs
@@ -30,7 +30,7 @@ impl operand_type_enum::OperandType {
         unsafe {
             let buffer_size = RabbitizerOperandType_getBufferSize(*self, instr, imm_override_len);
 
-            let mut buffer: Vec<u8> = vec![0; buffer_size];
+            let mut buffer: Vec<u8> = vec![0; buffer_size + 1];
             let disassembled_size = RabbitizerOperandType_disassemble(
                 *self,
                 instr,