Issue 79: Detect use-after-free in sa_invoke. Synchronize processorHandleList traversal in SecProcessor_Release

[riwoh]

Issue 79: Detect use-after-free in sa_invoke. Synchronize processorHandleList traversal in SecProcessor_Release

[Copilot]

Pull request overview

This PR addresses Issue 79 by adding runtime detection for use-after-free processor handles in sa_invoke, synchronizing access to the global processor handle list during SecProcessor_Release, and adding a regression unit test to exercise the use-after-free scenario.

Changes:

• Add a new unit test testProcessorUseAfterFree and register it in the processor test suite.
• Register newly created Sec_ProcessorHandle instances in the global handle list earlier during SecProcessor_GetInstance_Directories initialization.
• Synchronize processorHandleList traversal in SecProcessor_Release and add list-membership validation to sa_invoke before locking the processor handle mutex.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
test/main/cpp/sec_api_utest_main.cpp	Registers the new processor use-after-free regression test in the test runner.
test/main/cpp/processor.h	Exposes the new testProcessorUseAfterFree test declaration.
test/main/cpp/processor.cpp	Implements the new regression test that calls an API with a freed processor handle.
src/sec_adapter_processor.c	Adds handle-list synchronization, earlier handle registration, and use-after-free detection in sa_invoke.

Comments suppressed due to low confidence (1)

src/sec_adapter_processor.c:385

• SecProcessor_Release unlinks processorHandle from processorHandleList before releasing SVP/opaque buffers. release_svp_buffer calls sa_invoke(..., SA_SVP_BUFFER_RELEASE, ...), and sa_invoke now rejects any handle not present in the global list, so SVP buffer releases will never reach sa_svp_buffer_release during processor teardown (risking leaks / incomplete cleanup). Consider keeping the handle in processorHandleList until after all cleanup that uses sa_invoke is complete (opaque buffers, etc.), or provide a teardown-safe path for SVP buffer release that bypasses the list-membership check.

    pthread_mutex_lock(&mutex);
    Sec_ProcessorHandle* tempHandle = processorHandleList;
    Sec_ProcessorHandle* parentHandle = NULL;
    while (tempHandle != NULL && tempHandle != processorHandle) {
        parentHandle = tempHandle;
        tempHandle = tempHandle->nextHandle;
    }

    if (tempHandle != processorHandle) {
        pthread_mutex_unlock(&mutex);
        SEC_LOG_ERROR("Attempting to free a handle that has already been freed");
        return SEC_RESULT_INVALID_HANDLE;
    }

    if (parentHandle == NULL)
        processorHandleList = tempHandle->nextHandle;
    else
        parentHandle->nextHandle = tempHandle->nextHandle;

    pthread_mutex_unlock(&mutex);

    while (processorHandle->opaque_buffer_handle != NULL)
        release_svp_buffer(processorHandle, processorHandle->opaque_buffer_handle->opaqueBufferHandle);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.