Fix UAF when passing TypeBuilder objects into some APIs

[plafosse]

This is a fundamental rewrite of how TypeBuilder objects are handled in the python API.

[CLAassistant]

All committers have signed the CLA.

[Copilot]

Pull Request Overview

This PR addresses a use-after-free (UAF) vulnerability by ensuring that immutable copies of Type and TypeBuilder objects are created before passing their handles to core functions. The changes prevent type objects from being garbage collected while their handles are still in use.

• Extracts immutable_copy() calls into local variables to maintain references throughout the lifetime of handle usage
• Adds a type_list to FunctionBuilder._to_core_struct() to preserve type object references
• Updates _to_core_struct() return signature to include the preserved type list
• Applies immutable copies consistently across all type-related API calls

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/types.py	Core changes to prevent UAF by storing immutable copies before extracting handles; removed unused handle property and _to_core_struct from TypeBuilder; updated FunctionBuilder._to_core_struct to return type_list
python/mediumlevelil.py	Applied immutable_copy() before calling _to_core_struct() to prevent UAF
python/highlevelil.py	Applied immutable_copy() before calling _to_core_struct() to prevent UAF
python/function.py	Applied immutable_copy() before accessing handles to prevent UAF across multiple function methods
python/binaryview.py	Applied immutable_copy() before accessing handles; updated isinstance checks to only check for Type after conversion

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[CouleeApps]

Good changes, a bunch of UAFs fixed here. This exposes a bunch of places where we do this pattern:

if isinstance(var_type, str):
	(var_type, _) = self.parse_type_string(var_type)
var_type = var_type.immutable_copy()

... to handle var_type being one of Type, TypeBuilder, or str. We may want to factor out this common pattern in a future change, since it is so common, and so that we don't miss any future calls to immutable_copy.