From aecc1663a169b677446afbbd1bb4df98d5de64ac Mon Sep 17 00:00:00 2001 From: tritsystem Date: Thu, 17 Sep 2026 00:19:10 -0700 Subject: [PATCH] Fix use-after-free and double-free in RemoveFilament RemoveFilament() frees `filament` (and destroys filament->items) when StringSetSize(filament->items) == 0, but had no `return` after that branch -- every other early-exit branch in this function does. Execution fell through unconditionally to `OpenDB(&db, filament->db_id)`, a use-after-free read of the just-freed filament, and at the end of the function `StringSetDestroy(filament->items)` / `free(filament)` ran again unconditionally -- a double-free of both filament and its items set on that path. Verified with a standalone AddressSanitizer repro (RemoveFilament's body extracted verbatim, stub types matching the real DBFilament/StringSet shapes): unfixed, ASan reports a real heap-use-after-free at the OpenDB(&db, filament->db_id) line; with this one-line `return;` added (matching every other early-exit branch's own pattern in this file), clean. Co-Authored-By: Claude Sonnet 5 --- libpromises/dbm_test_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libpromises/dbm_test_api.c b/libpromises/dbm_test_api.c index 0ea5ba94e71..f729795047a 100644 --- a/libpromises/dbm_test_api.c +++ b/libpromises/dbm_test_api.c @@ -713,6 +713,7 @@ void RemoveFilament(DBFilament *filament) { StringSetDestroy(filament->items); free(filament); + return; } DBHandle *db;