In rda_papi.cc, there is a use after free.
if (m_NCS_TASK_START(rda_callback_cb->task_handle) != NCSCC_RC_SUCCESS) {
m_NCS_MEM_FREE(rda_callback_cb, 0, 0, 0);
m_NCS_TASK_RELEASE(rda_callback_cb->task_handle);
rc = PCSRDA_RC_TASK_SPAWN_FAILED;
break;
}
commit 073936223278fe640aa8f68461e66dc00932aad2
Author: khanh.q.nguyen1 khanh.q.nguyen1@dektech.com.au
Date: Mon Apr 17 13:45:32 2023 +0700
Last edit: Nguyen Quoc Khanh 2023-04-20