[OpenOCD-commit] Main OpenOCD repository branch, master, updated. v0.12.0-1687-gc2fc07b7d

[openocd-gerrit <ope...@us...>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Main OpenOCD repository".

The branch, master has been updated
       via  c2fc07b7df9d4cc38c2e8c12177568ec4b80112a (commit)
      from  b66fefa8f46e4734f703693b5137c92fa61ee760 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c2fc07b7df9d4cc38c2e8c12177568ec4b80112a
Author: Tomas Vanek <va...@fb...>
Date:   Mon Sep 14 10:29:16 2026 +0200

    flash/nor/str9xpec: fix use after free
    
    The recent commit 54a33aeab039 ("flash/nor: drop some exit() calls")
    introduced the following problem:
    str9xpec_flash_bank_command() frees bank->driver_priv in the error
    path, but then still uses str9xpec_info->options for buf_set_u32()
    before returning. If str9xpec_build_block_list() fails, this becomes
    a use-after-free and can crash or corrupt the bank state during setup.
    
    Return immediately after cleanup.
    
    Checkpatch-ignore: BAD_SIGN_OFF
    Suggested-by: Github Copilot
    Change-Id: I1eee0696ba381f1f8521e0fde6fee731588fda9f
    Signed-off-by: Tomas Vanek <va...@fb...>
    Reviewed-on: https://review.openocd.org/c/openocd/+/9992
    Tested-by: jenkins
    Reviewed-by: Antonio Borneo <bor...@gm...>

diff --git a/src/flash/nor/str9xpec.c b/src/flash/nor/str9xpec.c
index 016f07410..78a03c7f8 100644
--- a/src/flash/nor/str9xpec.c
+++ b/src/flash/nor/str9xpec.c
@@ -286,12 +286,13 @@ FLASH_BANK_COMMAND_HANDLER(str9xpec_flash_bank_command)
 	if (retval != ERROR_OK) {
 		free(bank->driver_priv);
 		bank->driver_priv = NULL;
+		return retval;
 	}
 
 	/* clear option byte register */
 	buf_set_u32(str9xpec_info->options, 0, 64, 0);
 
-	return retval;
+	return ERROR_OK;
 }
 
 static int str9xpec_blank_check(struct flash_bank *bank, unsigned int first,

-----------------------------------------------------------------------

Summary of changes:
 src/flash/nor/str9xpec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
Main OpenOCD repository