Skip to content

Commit 05da9f9

Browse files
authored
[ASM] ensure struct is on the stack before passing to native code (#5882)
## Summary of changes Some crashes where reported where the stack trace showed the error occurred in the WAF, with the call starting in `Waf.UpdateWafAndDispose`. A review of this method spotted that a pointer to a struct stored in a object field was being passed to the WAF. This meant the GC might move the object, which could potentially lead to a crash.
1 parent fb2335d commit 05da9f9

File tree

4 files changed

+5
-4
lines changed

4 files changed

+5
-4
lines changed

tracer/src/Datadog.Trace/AppSec/Waf/Waf.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,8 @@ private unsafe UpdateResult UpdateWafAndDispose(IEncodeResult updateData)
136136
var diagnosticsValue = new DdwafObjectStruct { Type = DDWAF_OBJ_TYPE.DDWAF_OBJ_MAP };
137137
try
138138
{
139-
var newHandle = _wafLibraryInvoker.Update(_wafHandle, ref updateData.ResultDdwafObject, ref diagnosticsValue);
139+
var updateObject = updateData.ResultDdwafObject;
140+
var newHandle = _wafLibraryInvoker.Update(_wafHandle, ref updateObject, ref diagnosticsValue);
140141
if (newHandle != IntPtr.Zero)
141142
{
142143
var oldHandle = _wafHandle;

tracer/src/Datadog.Trace/AppSec/WafEncoding/Encoder.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -690,7 +690,7 @@ internal EncodeResult(List<IntPtr> pointers, UnmanagedMemoryPool pool, ref Ddwaf
690690
_result = result;
691691
}
692692

693-
public ref DdwafObjectStruct ResultDdwafObject => ref _result;
693+
public DdwafObjectStruct ResultDdwafObject => _result;
694694

695695
public void Dispose()
696696
{

tracer/src/Datadog.Trace/AppSec/WafEncoding/EncoderLegacy.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@ internal EncodeResult(DdwafObjectStruct obj, WafLibraryInvoker wafLibraryInvoker
334334
_wafLibraryInvoker = wafLibraryInvoker;
335335
}
336336

337-
public ref DdwafObjectStruct ResultDdwafObject => ref _resultDdwafObject;
337+
public DdwafObjectStruct ResultDdwafObject => _resultDdwafObject;
338338

339339
public void Dispose() => _wafLibraryInvoker.ObjectFree(ref _resultDdwafObject);
340340
}

tracer/src/Datadog.Trace/AppSec/WafEncoding/IEncodeResult.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ namespace Datadog.Trace.AppSec.WafEncoding;
1010

1111
internal interface IEncodeResult : IDisposable
1212
{
13-
public ref DdwafObjectStruct ResultDdwafObject { get; }
13+
public DdwafObjectStruct ResultDdwafObject { get; }
1414
}

0 commit comments

Comments
 (0)