DBO: Keep ref of parent in api to prevent ez uaf

Author: CouleeApps

binaryninjaapi.h

@@ -22401,6 +22401,8 @@ namespace BinaryNinja {
 
 	class DatabaseObject: public CoreRefCountObject<BNDatabaseObject, BNNewDatabaseObjectReference, BNFreeDatabaseObject>
 	{
+		Ref<DatabaseObject> m_parent;
+
 	public:
 		explicit DatabaseObject(BNDatabaseObject* database);
 

merge.cpp

@@ -27,6 +27,7 @@ using namespace std;
 DatabaseObject::DatabaseObject(BNDatabaseObject* object)
 {
 	m_object = object;
+	m_parent = GetParent();
 }
 
 

python/database.py

@@ -370,6 +370,9 @@ def __init__(self, handle):
 		self.handle = core.handle_of_type(handle, core.BNDatabaseObject)
 		self._children = None
 		self._dependencies = None
+		# Hold a strong reference to parent because normally children have a weak ref
+		# and their parent could be cleaned up without them
+		self._parent = self.parent
 
 	def __del__(self):
 		core.BNFreeDatabaseObject(self.handle)