Re: [PATCH] kconfig: preprocess: fix UAF and SEGV on self-referencing variables

[Julian Braha]

Hi Ruslan,

On 11/2/26 09:05, Ruslan Semchenko wrote:
> In variable_add(), when updating an existing simply expanded variable (:=),
> v->value was freed before calling expand_string(value). If the value
> referred to the variable itself (e.g. A := $(A)b), variable_expand()
> accessed the already freed memory, causing a heap-use-after-free.
> 
> Furthermore, for a new variable definition, an uninitialized variable
> struct was inserted into variable_list before expanding value. If value
> referred to the variable itself (e.g. B := $(B)x), variable_lookup()
> found the incomplete variable and dereferenced uninitialized v->value,
> causing a segmentation fault.
> 
> Fix both issues by computing the new value before modifying the existing
> variable or inserting a new one into variable_list.
Thanks for your time & effort, but this was already caught some time ago:
https://lore.kernel.org/all/20261008164504.3683811-1-lzsx618@xxxxxxxxx/

- Julian Braha