Stalker does not ensure the life-time of the transformer passed to follow_me.

[WorksButNotTested]

The transformer provided to Stalker.follow_me should remain in scope until the corresponding unfollow_me is called. It does not appear that this life-time constraint is described by the wrapper class here...

frida-rust/frida-gum/src/stalker.rs

Line 162 in c93bd23

transformer: &Transformer,

Perhaps the follow_me function should return a handle which calls unfollow_me when it falls out of scope and its Drop is called and whose lifetime is tied to the provided transformer? Or perhaps it is just simpler to ensure that the transformer outlives the stalker instance?

Its probably worth checking for other instances of the same issue elsewhere as I may have done the same for the observer stuff I was working on?

[domenukk]

If the transformer isn't used in other contexts (?), the function could also take transformer by value, and store it in the stalker struct

[meme]

I am not sure that it is simpler to ensure that the transformer outlives the stalker instance. Personally, I feel that follow_me returning some sort of cookie that is passed to unfollow_me is a good idea. It also ensures that unfollow_me cannot be called multiple times, or without a matching call to follow_me. If either of you are interested in implementing this feature, I am happy to review. Otherwise I can work on it when time permits.

[WorksButNotTested]

Also, does this line take a double-reference to the event-sink into the user_data?

frida-rust/frida-gum/src/stalker/event_sink.rs

Line 142 in 6d287d1

user_data: &mut event_sink as *mut _ as *mut c_void,

I had a few problems when I copied the approach for the StalkerObserver and end up with something subtly different?

frida-rust/frida-gum/src/stalker/observer.rs

Line 46 in 6d287d1

user_data: stalker_observer as *mut S as *mut c_void,

[domenukk]

Probably the function should just take a mut ptr directly(?)
At least, accessing a &mut borrow from FFI can lead to UB if it's still used in rust afterwards (not sure if it ever is?)

[s1341]

Is this issue closed?

[WorksButNotTested]

I'm not sure. Looks like the PR which mentioned it above was closed and not merged?

[s1341]

do you mind taking a peek at the code to see if the issue has been fixed?

[WorksButNotTested]

From what I can see, it looks like these 3 APIs mentioned above might all have the same issue, that they take a parameter by reference and expect that it's lifetime extends beyond that of just the function call:

• Stalker
• EventSink
• Observer

[s1341]

Do you feel like taking a stab at a PR to fix them?