Skip to content

Conversation

@odaysec
Copy link

@odaysec odaysec commented Jan 21, 2026

fix avoid accessing any members of ret after calling free(ret). If tsf_type_destroy must be called on ret->type, do so before freeing ret, or copy ret->type into a local variable before freeing ret and then destroy that local variable.

Best concrete fix here: On the error path in the TSF_TK_STRUCT case where allocation of ret->u.c.array fails, reorder the cleanup so that tsf_type_destroy(ret->type) is called before free(ret). This ensures there is no member access through a freed pointer, while preserving the existing behavior and error reporting. No new headers or helper functions are required.

Specific changes:

  • In wasm/TSF/tsf_reflect.c, inside tsf_reflect_create, locate the case TSF_TK_STRUCT: branch.
  • In the if (ret->u.c.array == NULL) error block, move tsf_type_destroy(ret->type); to appear before free(ret);, or equivalently, swap lines 93 and 94.
  • The resulting order in that block should be:
    1. tsf_type_destroy(ret->type);
    2. free(ret);
    3. tsf_set_errno(...);
    4. return NULL;

@netlify
Copy link

netlify bot commented Jan 21, 2026

Deploy Preview for webkit-jetstream-preview ready!

Name Link
🔨 Latest commit 08a42b9
🔍 Latest deploy log https://app.netlify.com/projects/webkit-jetstream-preview/deploys/6970abe69b4d6e000881aa90
😎 Deploy Preview https://deploy-preview-267--webkit-jetstream-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant