From fb9b15eac660d2ada65971e54525f0b1fcead858 Mon Sep 17 00:00:00 2001 From: NOT XVilka Date: Tue, 9 Jun 2026 12:24:12 +0800 Subject: [PATCH] Fix pre-existing memory leaks in ObjC class and winkd module handling (#6471) bin/dyldcache: dyldcache_classes() built the classes vector with rz_pvector_new(free) and the per-class methods/fields lists with rz_list_new() (no element destructor). Each RzBinClass was therefore plain free()'d without releasing its name, methods and fields, leaking memory. debug/dmp (winkd): rz_debug_dmp_init() obtained the module list from winkd_list_modules() in the non-triage branch, scanned it for ntoskrnl.exe and then never freed it, leaking the list and all of its WindModule entries. Co-authored-by: Anton Kochkov --- librz/bin/p/bin_dyldcache.c | 6 +++--- librz/debug/p/debug_dmp.c | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/librz/bin/p/bin_dyldcache.c b/librz/bin/p/bin_dyldcache.c index e472d8dca7..db4fe17282 100644 --- a/librz/bin/p/bin_dyldcache.c +++ b/librz/bin/p/bin_dyldcache.c @@ -378,7 +378,7 @@ static RzPVector /**/ *dyldcache_classes(RzBinFile *bf) { return NULL; } - RzPVector *ret = rz_pvector_new(free); + RzPVector *ret = rz_pvector_new((RzPVectorFree)rz_bin_class_free); if (!ret) { return NULL; } @@ -451,8 +451,8 @@ static RzPVector /**/ *dyldcache_classes(RzBinFile *bf) { RzBinClass *klass; if (!(klass = RZ_NEW0(RzBinClass)) || - !(klass->methods = rz_list_new()) || - !(klass->fields = rz_list_new())) { + !(klass->methods = rz_list_newf((RzListFree)rz_bin_symbol_free)) || + !(klass->fields = rz_list_newf((RzListFree)rz_bin_class_field_free))) { RZ_FREE(klass); RZ_FREE(pointers); RZ_FREE(sections); diff --git a/librz/debug/p/debug_dmp.c b/librz/debug/p/debug_dmp.c index 734a0742b6..e1e72284eb 100644 --- a/librz/debug/p/debug_dmp.c +++ b/librz/debug/p/debug_dmp.c @@ -116,6 +116,7 @@ static bool rz_debug_dmp_init(RzDebug *dbg, void **user) { // Find ntoskrnl.exe module RzListIter *it; WindModule mod = { 0 }; + RzList *modules = NULL; if (ctx->type == DMP_DUMPTYPE_TRIAGE) { struct rz_bin_dmp64_obj_t *obj = core->bin->cur->o->bin_obj; dmp_driver_desc *driver; @@ -131,7 +132,7 @@ static bool rz_debug_dmp_init(RzDebug *dbg, void **user) { } else { WindProc kernel = { .dir_base_table = ctx->kernelDirectoryTable, .uniqueid = 4 }; ctx->windctx.target = kernel; - RzList *modules = winkd_list_modules(&ctx->windctx); + modules = winkd_list_modules(&ctx->windctx); WindModule *m; rz_list_foreach (modules, it, m) { if (rz_str_endswith(m->name, "\\ntoskrnl.exe")) { @@ -164,6 +165,7 @@ static bool rz_debug_dmp_init(RzDebug *dbg, void **user) { RZ_LOG_WARN("Failed to download ntoskrnl.pdb, many things won't work.\n"); } } + rz_list_free(modules); if (!ctx->windctx.profile) { RZ_LOG_ERROR("Could not find a profile for this Windows: %s %" PFMT32d "-bit %" PFMT32u " SP %" PFMT32u "\n",