Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SharedCache] Crash in SymbolTableView constructor background thread #6300

Open
WeiN76LQh opened this issue Jan 4, 2025 · 0 comments
Open
Labels
Component: DSC Issue needs changes to the DyldSharedCacheView

Comments

@WeiN76LQh
Copy link

Version and Platform (required):

  • Binary Ninja Version: 4.3.6635-dev (6a04b0e5)
  • OS: macOS
  • OS Version: 15.1.1
  • CPU Architecture: M1

Bug Description:
Closing a DSC triage view can cause a crash in the SymbolTableView constructor at the linked line. It appears to be a UAF due to the SymbolTableView being deleted and then the lambda being executed. BackgroundThread seems to state that it guarantees this can't happen by passing the SymbolTableView as the owner to the BackgroundThread. However, in this case, it seems to not be true. No idea why.

Steps To Reproduce:

  1. Open a copy of DSC in Binary Ninja.
  2. Open the DSCTraige/Dyld Shared Cache Triage view.
  3. Split that view so it opens another DSCTraige/Dyld Shared Cache Triage view next to it and then immediately close the new one.
  4. Wait for a bit, the crash should occur within 10 seconds, how long it takes can vary a bit.
@WeiN76LQh WeiN76LQh changed the title [SharedCache] Crash SymbolTableView constructor background thread [SharedCache] Crash in SymbolTableView constructor background thread Jan 4, 2025
@xusheng6 xusheng6 added the Component: DSC Issue needs changes to the DyldSharedCacheView label Jan 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Component: DSC Issue needs changes to the DyldSharedCacheView
Projects
None yet
Development

No branches or pull requests

2 participants