Skip to content

Fix dangling arch pointer in gen_bpf - #498

Open
virajmalia wants to merge 1 commit into
seccomp:mainfrom
virajmalia:fix-bpf-cwe-562
Open

virajmalia wants to merge 1 commit into
seccomp:mainfrom
virajmalia:fix-bpf-cwe-562

Conversation

@virajmalia

@virajmalia virajmalia commented Sep 17, 2026

Copy link
Copy Markdown

Problem

I ran a cppcheck scan on the repository and found 2 instances of state->arch = &pseudo_arch that are not reset before 6 return paths:

<error id="autoVariables" severity="error" msg="Address of local auto-variable assigned to a function parameter." verbose="Dangerous assignment - the function parameter is assigned the address of a local auto-variable. Local auto-variables are reserved from the stack which is freed when the function ends. So the pointer to a local variable is invalid after the function ends." cwe="562">
    <location file="/workspace/src/gen_bpf.c" line="2029" column="2"/>
</error>
<error id="autoVariables" severity="error" msg="Address of local auto-variable assigned to a function parameter." verbose="Dangerous assignment - the function parameter is assigned the address of a local auto-variable. Local auto-variables are reserved from the stack which is freed when the function ends. So the pointer to a local variable is invalid after the function ends." cwe="562">
    <location file="/workspace/src/gen_bpf.c" line="2102" column="2"/>
</error>

state->arch has a longer lifetime than pseudo_arch and the function _gen_bpf_build_bpf returns without resetting state->arch.

Fix

  • Set state->arch = NULL before the return statements

Why?

  • Although there are no use-after-free instances that I could find, future code modifications may not be verifying that, so it makes sense to keep the code clean and avoid future problems.

Verification

  • Build and tests passed locally

Signed-off-by: Viraj Malia <virajmalia2@gmail.com>
@virajmalia
virajmalia marked this pull request as ready for review September 17, 2026 21:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant