Skip to content

fix(strbuf): resolve potential use-after-free and UB in ffStrbufSetNS#2265

Open
fam007e wants to merge 1 commit intofastfetch-cli:devfrom
fam007e:fix/strbuf-uaf
Open

fix(strbuf): resolve potential use-after-free and UB in ffStrbufSetNS#2265
fam007e wants to merge 1 commit intofastfetch-cli:devfrom
fam007e:fix/strbuf-uaf

Conversation

@fam007e
Copy link
Copy Markdown
Contributor

@fam007e fam007e commented Apr 8, 2026

Summary

This PR fixes a "Potential use after free" security alert flagged by CodeQL and addresses Undefined Behavior (UB) when setting a buffer to a substring of itself.

Related issue (required for new logos for new distros)

Fixes a CodeQL security alert (no public issue was found).

Changes

  • Use-After-Free Fix: Modified ffStrbufSetNS to allocate and copy into a new buffer before freeing the old one. This ensures that if the source value points into the current buffer, it remains valid during the copy even if reallocation is required.
  • Overlap Safety: Replaced memcpy with memmove in the non-reallocating path to safely handle cases where value points to an overlapping memory region within the same buffer.

Checklist

  • I have tested my changes locally. (Verified with fastfetch-test-strbuf)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant