Skip to content
  • Brad King's avatar
    export: Fix use-after-free on multiple calls overwriting same FILE · 8affe9aa
    Brad King authored
    CMake 3.16 and below allow multiple `export()` calls with the same output
    file even without using `APPEND`.  The implementation worked by accident
    by leaking memory.  Refactoring in commit 5444a809 (cmGlobalGenerator:
    modernize memrory managemenbt, 2019-12-29, v3.17.0-rc1~239^2) cleaned up
    that memory leak and converted it to a use-after-free instead.
    
    The problem is caused by using the `cmGlobalGenerator::BuildExportSets`
    map to own `cmExportBuildFileGenerator` instances.  It can own only
    one instance per output FILE name at a time, so repeating use of the
    same file now frees the old `cmExportBuildFileGenerator` instance
    and leaves the pointer in the `cmMakefile::ExportBuildFileGenerators`
    vector dangling.  Move ownership of the instances into `cmMakefile`'s
    vector since its entries are not replaced on a repeat output FILE.
    
    In future work we should introduce a policy to error out on this case.
    For now simply fix the use-after-free to restore CMake <= 3.16 behavior.
    
    Fixes: #20469
    8affe9aa