Menu

#3332 rde: incorrect use of pointer

5.23.07
fixed
None
defect
rde
-
major
False
2023-04-20
2023-03-27
Gary Lee
No

In rda_papi.cc, there is a use after free.

if (m_NCS_TASK_START(rda_callback_cb->task_handle) != NCSCC_RC_SUCCESS) {
  m_NCS_MEM_FREE(rda_callback_cb, 0, 0, 0);
  m_NCS_TASK_RELEASE(rda_callback_cb->task_handle);
  rc = PCSRDA_RC_TASK_SPAWN_FAILED;
  break;
}

Related

Wiki: ChangeLog-5.23.07

Discussion

  • Gary Lee

    Gary Lee - 2023-03-27
    • Milestone: 5.23.03 --> 5.23.07
     
  • Nguyen Quoc Khanh

    • status: unassigned --> assigned
     
  • Nguyen Quoc Khanh

    • status: assigned --> accepted
    • assigned_to: Nguyen Quoc Khanh
     
  • Nguyen Quoc Khanh

    • status: accepted --> review
     
  • Nguyen Quoc Khanh

    commit 073936223278fe640aa8f68461e66dc00932aad2
    Author: khanh.q.nguyen1 khanh.q.nguyen1@dektech.com.au
    Date: Mon Apr 17 13:45:32 2023 +0700

    rde: fix pointer used after free [#3332]
    
    This fix moves the free function to a more appropriate position.
    
     

    Last edit: Nguyen Quoc Khanh 2023-04-20
  • Nguyen Quoc Khanh

    • status: review --> fixed
     

Log in to post a comment.